codefmt
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/format-uncommitted.ktsexecutes the systemgitcommand usingProcessBuilderto retrieve a list of modified files. The command is restricted to specific, non-configurable arguments (status,--porcelain), which minimizes the risk of command injection. - [REMOTE_CODE_EXECUTION]: The skill operates by generating Kotlin scripts from templates and passing them to the
steroid_execute_codetool for execution within the IntelliJ IDEA environment. This dynamic script generation and execution pattern is the core functionality of the skill but represents a high-privilege execution capability.
Audit Metadata