codefmt

Pass

Audited by Gen Agent Trust Hub on Jul 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/format-uncommitted.kts executes the system git command using ProcessBuilder to retrieve a list of modified files. The command is restricted to specific, non-configurable arguments (status, --porcelain), which minimizes the risk of command injection.
  • [REMOTE_CODE_EXECUTION]: The skill operates by generating Kotlin scripts from templates and passing them to the steroid_execute_code tool for execution within the IntelliJ IDEA environment. This dynamic script generation and execution pattern is the core functionality of the skill but represents a high-privilege execution capability.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 28, 2026, 10:39 AM
Security Audit — agent-trust-hub — codefmt