tech-debt
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/find-polluter.shexecutesnpm teston files matching a search pattern to identify tests that leave unwanted side effects. This is a standard development utility.\n- [INDIRECT_PROMPT_INJECTION]: Thescripts/dependency_analyzer.pyscript creates an attack surface by processing untrusted project files.\n - Ingestion points: Reads project source and config files (e.g.,
package.json,requirements.txt,go.mod) from the project directory.\n - Boundary markers: The script does not use explicit delimiters in its output to separate extracted import data from the rest of the agent's context.\n
- Capability inventory: The skill facilitates execution of shell commands and testing tools via
scripts/find-polluter.sh.\n - Sanitization: The script uses static regular expression matching to extract dependency information and does not execute code from the scanned files.\n- [EXTERNAL_DOWNLOADS]: The
SKILL.mdinstructions guide the agent to install external skills using a local installation script. These resources are part of the author's official plugin ecosystem and are used for modular skill management.
Audit Metadata