codemap
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
codemapCLI for codebase indexing and analysis. All bash commands are for legitimate code analysis and management purposes. - [EXTERNAL_DOWNLOADS]: The skill refers to the
@ulpi/codemappackage on NPM. The instructions specifically mandate that the AI must not perform automatic installations, ensuring human oversight for external software acquisition. - [PROMPT_INJECTION]: The skill ingests project code through search and analysis tools, which constitutes an indirect prompt injection surface. The risk is minimized by the tool's intended use-case and the author's inclusion of safety-first installation protocols.
- Ingestion points:
codemap search,codemap read, andcodemap summaryprocess source code files. - Boundary markers: None defined to isolate ingested code from AI instructions.
- Capability inventory: Shell execution, file system read/write, and potential network access for updates (SKILL.md).
- Sanitization: Not explicitly implemented in the provided skill instructions.
Audit Metadata