skapxd-tree
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill executes '@skapxd/tree@1.3.1' via npx, which involves downloading code from the npm registry at runtime. The package is a vendor resource and is pinned to a specific version for stability.
- [COMMAND_EXECUTION]: The skill uses the 'npx' command to run project mapping tools on the local file system, including support for directory outlines and file relationship graphs.
- [PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by design, as it processes local files and Markdown links to generate context for the agent.
- Ingestion points: The 'npx' command reads local source files (TypeScript, JavaScript, Astro) and Markdown documents.
- Boundary markers: No explicit instructions for delimiters or 'ignore embedded instructions' warnings are provided.
- Capability inventory: The skill utilizes shell command execution ('npx') to read and analyze file structures.
- Sanitization: No sanitization or content filtering is specified for the data read from project files.
Audit Metadata