The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run node .gitnexus/run.cjs. This file resides within the .gitnexus directory of the repository currently being processed. If an attacker controls the repository, they can place malicious code in this file to execute arbitrary commands on the host machine.
[REMOTE_CODE_EXECUTION]: The skill recommends using npx gitnexus or pnpm dlx to install and run the tool. The specific pnpm command includes --allow-build flags for gitnexus, @ladybugdb/core, and tree-sitter. This grants these packages permission to run arbitrary scripts during the installation process, which is a significant security risk for unvetted third-party packages.
[DATA_EXFILTRATION]: The wiki command includes a --gist flag that publishes documentation generated from the codebase as a public GitHub Gist. This functionality could result in the public exposure of sensitive project information, internal documentation, or intellectual property without explicit user awareness of the destination.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its core indexing mechanism.
Ingestion points: The analyze command parses all source files within the project root to build a knowledge graph and generate context files (CLAUDE.md and AGENTS.md).
Boundary markers: The instructions do not specify any delimiters or boundary markers to separate code content from instructions, potentially allowing the agent to follow directions embedded in code comments or strings.
Capability inventory: The skill possesses the ability to execute local scripts via node, download and install packages via npx/pnpm, write to the filesystem, and publish data to external web services.
Sanitization: No sanitization, filtering, or validation of the repository's source code is performed before it is incorporated into the agent's context files.
[CREDENTIALS_UNSAFE]: The documentation indicates that the wiki command saves an LLM API key to ~/.gitnexus/config.json. Storing credentials in a predictable local file without encryption makes them accessible to other scripts or tools that might be executed within the same environment.

gitnexus-cli