code-review-graph
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the
code-review-graphpackage using pip, pipx, or uvx. This is a vendor-owned resource associated with the author 'vudovn' and the instructions mandate user confirmation before proceeding with the installation. - [COMMAND_EXECUTION]: The skill utilizes
Bashto perform environmental checks and execute graph construction commands likebuild,watch, andupdate. These operations are limited to the local workspace and are gated by confirmation protocols to ensure user oversight. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a potential attack surface for indirect prompt injection through its codebase scanning functionality.
- Ingestion points: The tool parses project files using Tree-sitter to build a structural graph (SKILL.md).
- Boundary markers: No explicit boundary markers or 'ignore' instructions for embedded content are defined in the instructions.
- Capability inventory: The skill has access to
Bash,Read,Grep, andGlob(SKILL.md). - Sanitization: The tool performs structural analysis (AST) using Tree-sitter rather than natural language interpretation of file content, which significantly reduces the risk of malicious instructions being executed.
Audit Metadata