codebase-researcher
Pass
Audited by Gen Agent Trust Hub on Mar 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/deep_research.shexecutes shell commands to discover directories and spawns subagents using theclaudeCLI withBashtool access enabled. Although the script defaults to a read-only permission mode, the configuration grants agents the capability to execute shell commands for system exploration.\n- [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it systematically processes untrusted codebase files and presents them to highly autonomous agents initialized with open-ended instructions (e.g., "complete freedom to choose your research approach").\n - Ingestion points: Local files (source code, documentation, configuration) read via
Read,Glob, andGreptools.\n - Boundary markers: Not present; instructions do not include delimiters or warnings to ignore embedded directives in codebase files.\n
- Capability inventory:
Read,Glob,Grep,Bash, and filesystem writes via the research script output redirection.\n - Sanitization: Absent; the skill extracts and summarizes content from all discovered code files without filtering for malicious prompt patterns.
Audit Metadata