code-purge
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various static analysis tools (e.g., vulture, pyflakes, knip, jscpd) and project test suites (e.g., pytest, npm test, go test) using subprocess calls in scripts/analyze.py and scripts/run_tests.sh. These operations are restricted to identifying dead code and verifying the cleanup process as requested by the user.
- [INDIRECT_PROMPT_INJECTION]: The skill acts on codebase content which serves as an ingestion point for untrusted data.
- Ingestion points: scripts/analyze.py and the manual analysis instructions in SKILL.md read files from the project root.
- Boundary markers: The skill strictly follows a five-phase workflow that requires explicit user confirmation of findings and scope (Phase 2) before proceeding to backup or cleaning phases.
- Capability inventory: The agent can execute analysis tools, create project backups via scripts/backup.sh, perform file deletions/modifications, and execute detected test suites via scripts/run_tests.sh.
- Sanitization: The skill relies on the human-in-the-loop 'Report & Confirm' phase and the requirement for a verified test run to mitigate risks associated with processing potentially malicious code content.
- [SAFE]: External tool recommendations and dependency management practices align with secure development standards. The skill explicitly advises using project-pinned executables and avoiding unpinned package downloads during analysis.
Audit Metadata