skills/victorzhuk/skills/z-codegraph/Gen Agent Trust Hub

z-codegraph

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use the codegraph CLI tool via various shell commands (e.g., codegraph explore, codegraph query, codegraph impact) to perform code analysis tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill creates a potential command injection surface by interpolating user-provided inputs directly into shell execution strings.
  • Ingestion points: The skill accepts variables like <question or symbols>, <symbol-or-file>, and <changed-files...> from user-provided tasks in SKILL.md.
  • Boundary markers: No explicit delimiters or boundary markers are defined for the user-supplied variables within the command templates.
  • Capability inventory: The skill exposes shell execution capabilities through multiple subcommands of the codegraph utility as documented in SKILL.md.
  • Sanitization: There are no instructions or mechanisms provided to sanitize or escape special shell characters in the user-supplied arguments before execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 09:29 AM