codepulse-shared

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The bundled lizard.py tool uses importlib.import_module to dynamically load extensions from its local lizard_ext package based on provided arguments.
  • [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves analyzing external, untrusted repository code. It provides shared standards and schemas that explicitly mandate HTML escaping and prohibit raw HTML or script execution from analyzed content, as documented in renderers/html-template.md and references/runtime-contract.md.
  • [COMMAND_EXECUTION]: The lizardwordcount extension uses webbrowser.open to display results in a local browser session, interacting with the host environment outside of the standard CLI output stream.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 02:53 PM