codegraph-skill

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill defines several CLI-based operations for the agent to execute, such as querying symbol definitions, call chains, and impact analysis using the codegraph utility.
  • [EXTERNAL_DOWNLOADS]: The command resolution logic includes fallback mechanisms using bunx and npx to fetch and execute the codegraph and @terrain-ai/cli packages from the NPM registry if they are not available in the local directory.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project source code to generate and query an AST graph. While it does not directly ingest untrusted network data, the reading of local codebase content presents a surface where malicious source code or comments could attempt to influence agent responses during code analysis.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 02:44 PM