Skip to content
← Registry
Trust Report

agentifind

Set up codebase intelligence for AI agents. Runs the agentifind CLI to extract code structure using LSP (pyright/tsserver) with tree-sitter fallback, then synthesizes a CODEBASE.md navigation guide. Run this skill to get a complete codebase map in .claude/ directory.

62
SUSPICIOUS
Format: openclawScanner: v0.8.0Duration: 44msScanned: 10d ago · Apr 30, 10:05 AMSource →
Open community →Automate with the API →Join the discussion →Jump to findings →
Embed this badge
AgentVerus SUSPICIOUS 62AgentVerus SUSPICIOUS 62AgentVerus SUSPICIOUS 62
[![AgentVerus](https://agentverus.ai/api/v1/skill/9543f9c5-000f-44a5-9044-274ed736ca40/badge)](https://agentverus.ai/skill/9543f9c5-000f-44a5-9044-274ed736ca40)
Community Discussion

Community Comments

Public comments are the active feedback surface on skill reports right now. Use them to share implementation notes, edge cases, and operator context.

0 comments

Sign in to comment on this skill

No comments yet. Be the first to share your thoughts.

Continue the workflow

Keep this report moving through the activation path: rescan from the submit flow, capture real-world interactions, and wire the trust endpoint into your automation.

Rescan this skill →Record an interaction →Open comments →Automate this report →
https://agentverus.ai/api/v1/skill/9543f9c5-000f-44a5-9044-274ed736ca40/trust
Personalized next commands

Use these current-skill command blocks to keep this exact report moving through your workflow.

Record an interaction
curl -X POST https://agentverus.ai/api/v1/interactions \
  -H "Authorization: Bearer at_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"agentPlatform":"openclaw","skillId":"9543f9c5-000f-44a5-9044-274ed736ca40","interactedAt":"2026-03-15T12:00:00Z","outcome":"success"}'
Fetch trust JSON
curl https://agentverus.ai/api/v1/skill/9543f9c5-000f-44a5-9044-274ed736ca40/trust

Category Scores

72
Permissions
25
Injection
100
Dependencies
70
Behavioral
90
Content
100
Code Safety

Findings (9)

highCapability contract mismatch: inferred command execution is not declared-12

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: Execute

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03
highComprehensive secret collection detected-25

Found comprehensive secret collection pattern: "list key"

│ └── inputs: {list key variables}

→ Skills should not instruct collection of all tokens, keys, or credentials. Access only the specific credentials needed and declare them.

injectionASST-05
highHidden instructions in HTML comment-25

HTML comment contains instruction-like content that may be an attempt to inject hidden behavior.

<!-- STALENESS METADATA - DO NOT EDIT -->

→ Remove hidden instructions from HTML comments. All skill behavior should be visible.

injectionASST-01
highHidden instructions in HTML comment-25

HTML comment contains instruction-like content that may be an attempt to inject hidden behavior.

<!-- STALENESS METADATA - DO NOT EDIT -->

→ Remove hidden instructions from HTML comments. All skill behavior should be visible.

injectionASST-01
highConfig tamper core detected-25

Found config tamper core pattern: "Append this section to the file (or create `AGENTS.md"

Append this section to the file (or create `AGENTS.md` if neither exists):

→ Do not instruct users to write, edit, or otherwise modify trust-boundary workspace files like AGENTS.md, TOOLS.md, or CLAUDE.md. Treat them as user-owned policy/configuration and keep the skill self-contained.

behavioralASST-03
mediumCapability contract mismatch: inferred file write is not declared-8

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: Append this section to the file

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03
mediumCapability contract mismatch: inferred package bootstrap is not declared-8

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: npx agentifind@latest

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03
mediumPackage bootstrap execution detected (inside code block)-5

Found package bootstrap execution pattern: "npx agentifind@latest"

npx agentifind@latest sync

→ Surface package bootstrap commands for review. Ephemeral package execution and install-time dependency pulls increase supply-chain risk, especially when versions are not pinned or provenance is unclear.

behavioralASST-04
infoSafety boundaries defined

The skill includes explicit safety boundaries defining what it should NOT do.

Safety boundary patterns detected in content

→ Keep these safety boundaries. They improve trust.

contentASST-09