code-complexity-scanner
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install standard code analysis tools lizard and radon using the pip package manager.
- [COMMAND_EXECUTION]: Executes shell commands to run static analysis tools (lizard, radon, npx eslint) against the local codebase to generate metrics.
- [INDIRECT_PROMPT_INJECTION]: The skill processes source code from the user's project, creating a surface where malicious instructions embedded in code comments or strings could potentially influence the agent. 1. Ingestion points: Source code files across the repository (SKILL.md). 2. Boundary markers: Absent; the instructions do not include specific delimiters or warnings to ignore instructions found within the scanned files. 3. Capability inventory: File system access (read), package installation, and shell command execution. 4. Sanitization: Absent; the skill does not specify any sanitization or escaping of the code content before analysis.
Audit Metadata