codebase-mapper

Pass

Audited by Gen Agent Trust Hub on Mar 4, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXPOSURE]: The skill reads the file system structure to create a map. It implements a safety check to refuse mapping the root directory ('/') and excludes common directories like '.git', 'node_modules', and 'dist' to prevent the inadvertent collection of sensitive metadata.
  • [COMMAND_EXECUTION]: No patterns for arbitrary command execution were found. The skill uses yargs for CLI argument parsing and does not utilize eval or subprocess spawning.
  • [REMOTE_CODE_EXECUTION]: The skill does not perform any network operations or remote script downloads. All logic is contained within the local source files and standard dependencies.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of directory and file names from the local file system. While this presents an attack surface where an attacker could name a file with malicious instructions, the risk is mitigated by the skill's specific purpose and the expected guardrails of the parent agent processing the output.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 4, 2026, 10:51 PM