sdd-explore
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTIONNO_CODE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Recommends that the user install an external CLI utility called
code-review-graphusing theuvpackage manager to assist with codebase analysis. - [COMMAND_EXECUTION]: Directs the agent to execute the
code-review-graph buildcommand and to perform file system operations, such as creating and appending to.specs/.sdd/suggested-tools, to track tool recommendations. - [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection as it is designed to read and interpret content from the user's codebase and specifications.
- Ingestion points: Files in the codebase and the
.specs/directory (SKILL.md). - Boundary markers: None identified; the skill does not use markers to separate untrusted codebase content from its instructions.
- Capability inventory: Reading local files, writing to the
.specs/directory, and executing a specific CLI tool. - Sanitization: The skill does not perform sanitization of the content read from files before the agent processes it.
- [NO_CODE]: This skill consists entirely of instructions within the SKILL.md file and does not include any accompanying scripts or executable files.
Audit Metadata