Is anivar/contributor-codebase-analyzer safe?
Yes. anivar/contributor-codebase-analyzer is safe to install. Oathe's behavioral security audit gave the contributor-codebase-analyzer skill by anivar a trust score of 88/100 with 2 findings, none critical or high.
https://github.com/anivar/contributor-codebase-analyzer
Is anivar/contributor-codebase-analyzer safe to install?
This appears to be a legitimate codebase analysis tool with comprehensive security documentation and proper defense mechanisms against prompt injection. While it accessed sensitive files during installation, no actual data exfiltration occurred and canary integrity was preserved.
What security issues were found in anivar/contributor-codebase-analyzer?
Category Scores
Findings (2)
MEDIUM Accessed sensitive canary files -15 ▶
The skill accessed multiple sensitive canary files including .env, SSH keys, AWS credentials, and other security-sensitive files during installation. However, canary integrity checks confirm no data was actually exfiltrated.
LOW Canary file access without modification -10 ▶
The skill accessed honeypot files but did not modify or exfiltrate them, suggesting filesystem scanning behavior rather than malicious intent.
Should I install anivar/contributor-codebase-analyzer?
Oathe's verdict for anivar/contributor-codebase-analyzer is SAFE with a trust score of 88/100. Recommendation: Install with caution.