claude-cartographer

The project extensively uses regular expressions and Python's AST module to parse and analyze source code files, including identifying security-relevant patterns (e.g., `eval`, `system`, SQL queries, XSS sinks) within the *target codebase*. These identified patterns are for static analysis and are not executed by the tool itself. The `bootstrap.py` installer and the `cli.py` module use `subprocess.run` for standard operations like virtual environment management, package installation (`pip`), and executing the `claude-map` binary itself. Inputs to these subprocess calls are derived from resolved file paths or hardcoded commands, mitigating direct shell injection risks. The Claude Code hooks queue file paths via `echo` to a text file, which is then processed by the `claude-map update` command, further limiting direct command injection from file paths.