c4-code
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates on local code directories to extract structural information for documentation purposes. This behavior is consistent with its stated goal and does not involve accessing sensitive system credentials or environment variables.
- [PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection by processing untrusted data from local code directories (e.g., via directory analysis instructions in SKILL.md). However, it lacks the high-risk capabilities necessary to exploit this vector. Ingestion points: local code directories. Boundary markers: absent. Capability inventory: generation of documentation and Mermaid diagrams. Sanitization: absent.
Audit Metadata