graphicode-qa-linter
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill is designed for local linting. It uses the
catcommand to read project configuration, flow YAMLs, and source code files, but it does not utilize any network tools or instructions to transmit data externally. - [COMMAND_EXECUTION]: Shell commands are limited to safe, read-only operations using
cat. There are no instances of arbitrary command execution, privilege escalation (likesudo), or unsafe argument interpolation that could lead to command injection. - [REMOTE_CODE_EXECUTION]: The skill performs static analysis (linting) and does not download external scripts, install unverified packages, or use dynamic execution functions like
evalorexecon the code it reads. - [PROMPT_INJECTION]: The instructions provide a robust technical framework for validation. There are no attempts to override system prompts, bypass safety filters, or use adversarial role-play techniques.
- [SAFE]: The skill's behavior is consistent with its stated purpose as a code linter, adhering to the principle of least privilege by only requesting read access to relevant project files.
Audit Metadata