extracting-code-structure
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill describes the use of the
ts-packCLI tool for source code analysis. It also includes examples utilizing common development utilities likejqfor JSON manipulation andgit ls-filesfor identifying project files. - [INDIRECT_PROMPT_INJECTION]: The skill enables the agent to ingest external source code files. Comments and docstrings within these files could potentially harbor instructions intended to influence the agent's behavior during the analysis phase.
- Ingestion points: The
ts-pack process <file>command inSKILL.mdallows the agent to read and process content from local source files. - Boundary markers: The instructions do not specify any delimiters or warnings to the agent regarding the untrusted nature of the content found within docstrings or comments.
- Capability inventory: The skill uses the
ts-packCLI and thetree_sitter_language_packPython library for metadata extraction. - Sanitization: While the output is structured as JSON, there is no explicit mention of sanitizing the raw string content (such as docstrings) extracted from the files.
Audit Metadata