codegraph-skill
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill defines several CLI-based operations for the agent to execute, such as querying symbol definitions, call chains, and impact analysis using the
codegraphutility. - [EXTERNAL_DOWNLOADS]: The command resolution logic includes fallback mechanisms using
bunxandnpxto fetch and execute thecodegraphand@terrain-ai/clipackages from the NPM registry if they are not available in the local directory. - [INDIRECT_PROMPT_INJECTION]: The skill processes project source code to generate and query an AST graph. While it does not directly ingest untrusted network data, the reading of local codebase content presents a surface where malicious source code or comments could attempt to influence agent responses during code analysis.
Audit Metadata