codebase-readiness
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill runs a local shell script ('scripts/recon.sh') to perform initial reconnaissance and provides numerous shell commands ('find', 'grep', 'git', 'wc') for sub-agents to execute during the assessment phase. These commands are used for metadata gathering and structural analysis.
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it ingests and processes untrusted data from the codebase being analyzed, specifically from files like 'CLAUDE.md', 'README.md', and source code. Ingestion points: Content from any file in the analyzed codebase, including configuration files and documentation. Boundary markers: None. Instructions to the sub-agents do not include markers to distinguish between assessment instructions and data from the codebase. Capability inventory: File system access, shell command execution, and sub-agent spawning ('subagent_type: general-purpose'). Sanitization: None. Codebase content is directly interpolated into agent prompts.
- [EXTERNAL_DOWNLOADS]: The skill recommends the installation of the third-party tool 'btar' and suggests using a plugin ('agent-ready@dgalarza-workflows'). It also provides links to the author's website for further resources.
Audit Metadata