skills/yugasun/aiops/code-graph/Gen Agent Trust Hub

code-graph

Warn

Audited by Gen Agent Trust Hub on Jul 5, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the graphifyy package from PyPI using uv, pipx, or pip.
  • There is a discrepancy between the repository link provided (github.com/safishamsi/graphify) and the package name specified for installation (graphifyy).
  • [REMOTE_CODE_EXECUTION]: Provides instructions to install the uv tool by downloading and executing a shell script directly from astral.sh using curl | sh.
  • [COMMAND_EXECUTION]: Executes several shell commands at runtime to manage the code graph and analyze the repository:
  • Runs graphify . to parse the codebase and generate structural data.
  • Runs git log --oneline -30 to extract recent commit history for hotspot analysis.
  • Executes local Python scripts located at <aiops-root>/skills/aiops/scripts/code_graph_query.py to perform graph queries.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests and processes the entire project codebase (untrusted data) to build the graph.
  • Ingestion points: Reads the project directory via graphify in build-steps.md.
  • Boundary markers: None identified to separate code content from instructions.
  • Capability inventory: Subprocess calls for graphify and git, and execution of local Python scripts.
  • Sanitization: No explicit sanitization of code content before it is processed by the model for semantic annotation.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 5, 2026, 03:08 AM
Security Audit — agent-trust-hub — code-graph