code-explorer
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the
WebFetchtool to retrieve code from external sources such as GitHub repositories based on user input for analysis. - [COMMAND_EXECUTION]: The skill requests access to the
Bashtool in its configuration. While the current instructions focus on code analysis and explanation, the presence of this tool grants the agent the ability to execute shell commands on the local system. - [INDIRECT_PROMPT_INJECTION]: The skill represents an indirect prompt injection surface as it processes untrusted data from external codebases.
- Ingestion points: External code fetched via
WebFetchfrom user-provided URLs (SKILL.md). - Boundary markers: None explicitly defined in the instructions to separate fetched code from agent instructions.
- Capability inventory:
Bash,Read,Grep,WebFetch(SKILL.md frontmatter). - Sanitization: The skill relies on the agent's internal analysis and does not specify explicit validation or escaping of the fetched content.
Audit Metadata