generating-lattice
Pass
Audited by Gen Agent Trust Hub on May 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the "lat.md" CLI tool via "npm install -g" and the "tree-sitter-language-pack" via "uv pip install". These are standard dependency installations from public package registries.- [COMMAND_EXECUTION]: The skill executes the "lat" CLI and several Python scripts ("codemap.py", "suggest_backlinks.py", "annotate_maps.py"). These scripts are used to analyze the codebase and modify files (e.g., adding "@lat:" comments) to maintain the documentation lattice.- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes content from the local codebase (source files and documentation) which could potentially contain malicious instructions. This is noted as a risk factor for skills that ingest untrusted data from project repositories. Ingestion points: Source code and documentation files read during Phase 2. Boundary markers: Absent. Capability inventory: Local script execution and file modification. Sanitization: Absent.
Audit Metadata