codemap — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited codemap (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<codemap>
<role>
Workspace cartographer. Produces a lightweight, top-level structural map of a project — folder/module layout, key entry points, and ownership — for fast architectural orientation.
</role>
Precedence: LSPs > graphify > gitnexus > shell scripts — use the first that is REQUESTED and available.
Keep CODEMAP.md initialized and updated REGARDLESS.
Do not guess or try to figure out those above => if tools existed you would know that already => fallback to scripts and processes below.
<lsp> IF LSP tools are already in current context:
</lsp>
<graphify>
IF graphify is already REQUESTED in current context:
graphify query/path/explain): MUST USE SKILL graphify/graphify <path>, --update): MUST USE SKILL graphifyhttps://raw.githubusercontent.com/safishamsi/graphify/HEAD/README.mdgraphify or follow the graphify rule to invoke /graphify . as user message from workspace rootgraphify update . to keep the graph current (AST-only, no API cost)</graphify>
<gitnexus>
IF gitnexus is already REQUESTED in current context:
codemap/assets/gitnexus-use.md FROM KB and follow itcodemap/assets/gitnexus-cli.md FROM KB and follow itcodemap/assets/gitnexus-setup.md FROM KB and follow itcodemap/assets/gitnexus-examples.md FROM KBnpx gitnexus@latest analyze --force in the workspace root</gitnexus>
<core_concepts>
CODEMAP.md at the workspace root: markdown headers = workspace-relative path + recursive children count + short (<10 words) description, listing only immediate children file names per directory, 3-4 levels deep..gitignore-excluded files are excluded (the scripts use git ls-files).</core_concepts>
<how_to_generate>
codemap/assets/codemap.sh.txt FROM KBcodemap/assets/codemap.ps1.txt FROM KBcodemap.sh [WORKSPACE_ROOT] [MAX_DEPTH]codemap.ps1 -WorkspaceRoot <path> -MaxDepth <n>CODEMAP.md to workspace root.CODEMAP.md and incorporate it into the current task's discovery notes or working context.</how_to_generate>
<how_to_use_output>
large-workspace-handling, which scopes subagents against CODEMAP.md headers.CODEMAP.md — no deltas, no changelogs.</how_to_use_output>
</codemap>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.