codebase-mapper
Pass
Audited by Gen Agent Trust Hub on Mar 4, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill reads the file system structure to create a map. It implements a safety check to refuse mapping the root directory ('/') and excludes common directories like '.git', 'node_modules', and 'dist' to prevent the inadvertent collection of sensitive metadata.
- [COMMAND_EXECUTION]: No patterns for arbitrary command execution were found. The skill uses yargs for CLI argument parsing and does not utilize eval or subprocess spawning.
- [REMOTE_CODE_EXECUTION]: The skill does not perform any network operations or remote script downloads. All logic is contained within the local source files and standard dependencies.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of directory and file names from the local file system. While this presents an attack surface where an attacker could name a file with malicious instructions, the risk is mitigated by the skill's specific purpose and the expected guardrails of the parent agent processing the output.
Audit Metadata