nexus-mapper
Pass
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using the subprocess module to perform repository analysis, specifically in scripts/git_detective.py which runs git log and other history-related commands to identify code hotspots. It also performs environment checks for Python versioning and dependency availability.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of external Python dependencies, specifically tree-sitter and tree-sitter-language-pack, from standard package registries. These are well-known and trusted libraries used for multi-language code parsing.
- [PROMPT_INJECTION]: The skill generates a .nexus-map/INDEX.md file containing a 'Hard-Trigger Block'. This block uses imperative language to instruct future AI agents to read specific generated documentation and follow a strict sequence of operations before proceeding with tasks. While this is the primary intended functionality to provide context for cold-start sessions, it represents a surface for indirect prompt injection if the generated files were to be modified by an adversary.
Audit Metadata