tech-debt
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns detected. The skill contains utility scripts for technical debt analysis and follows standard development practices for the intended use case.
- [PROMPT_INJECTION]: The skill ingests codebase content for analysis, representing a surface for indirect prompt injection. Ingestion points: scripts/dependency_analyzer.py (reads project configuration and source files) and SKILL.md (monitors merged PRs). Boundary markers: No explicit delimiter-based isolation. Capability inventory: scripts/find-polluter.sh executes tests via npm; SKILL.md suggests automated refactoring and tool installation. Sanitization: Variables are quoted in shell scripts to prevent basic command injection. The risks are inherent to developer-focused agents and no specific exploitation attempts were found.
- [COMMAND_EXECUTION]: Includes a bisection script for identifying test polluters (scripts/find-polluter.sh) and a dependency analyzer. Commands are local to the project and intended for environment maintenance.
- [EXTERNAL_DOWNLOADS]: References external skill registries and configuration files located in the parent project structure (e.g., ../../../references/external-skills.yaml). These are legitimate internal references within the author's infrastructure.
Audit Metadata