codepulse-shared
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The bundled
lizard.pytool usesimportlib.import_moduleto dynamically load extensions from its locallizard_extpackage based on provided arguments. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves analyzing external, untrusted repository code. It provides shared standards and schemas that explicitly mandate HTML escaping and prohibit raw HTML or script execution from analyzed content, as documented in
renderers/html-template.mdandreferences/runtime-contract.md. - [COMMAND_EXECUTION]: The
lizardwordcountextension useswebbrowser.opento display results in a local browser session, interacting with the host environment outside of the standard CLI output stream.
Audit Metadata