tech-debt

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/find-polluter.sh executes npm test on files matching a search pattern to identify tests that leave unwanted side effects. This is a standard development utility.\n- [INDIRECT_PROMPT_INJECTION]: The scripts/dependency_analyzer.py script creates an attack surface by processing untrusted project files.\n
  • Ingestion points: Reads project source and config files (e.g., package.json, requirements.txt, go.mod) from the project directory.\n
  • Boundary markers: The script does not use explicit delimiters in its output to separate extracted import data from the rest of the agent's context.\n
  • Capability inventory: The skill facilitates execution of shell commands and testing tools via scripts/find-polluter.sh.\n
  • Sanitization: The script uses static regular expression matching to extract dependency information and does not execute code from the scanned files.\n- [EXTERNAL_DOWNLOADS]: The SKILL.md instructions guide the agent to install external skills using a local installation script. These resources are part of the author's official plugin ecosystem and are used for modular skill management.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 09:46 AM