codebase-health

Pass

Audited by Gen Agent Trust Hub on Mar 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to analyze git commit history for churn analysis and to run project-specific linters such as eslint, flake8, clippy, and dart analyze to gather health metrics.\n- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it is instructed to investigate the entire codebase—which may contain untrusted content—without explicit sanitization or instructions to ignore embedded commands.\n
  • Ingestion points: Project configuration files, source code, and commit history (SKILL.md)\n
  • Boundary markers: None specified.\n
  • Capability inventory: Shell command execution (linters, git) and local file system writes (SKILL.md)\n
  • Sanitization: None specified.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 23, 2026, 10:56 AM
Security Audit — agent-trust-hub — codebase-health