nuke-sweep
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes validation 'gate' commands (e.g.,
npm test,pytest,go test) to ensure code integrity after cleanup. These commands are dynamically resolved from the repository's own manifest files (such aspackage.jsonorpyproject.toml) or CI configurations, following standard development practices. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes untrusted code diffs to identify elements for removal.
- Ingestion points: Untrusted data is ingested through
git diffand direct file reads from the disk as specified in the SKILL.md instructions. - Boundary markers: Absent; the instructions do not specify the use of delimiters or 'ignore' instructions for the diff content.
- Capability inventory: The skill possesses the ability to delete lines from files (using grep for verification) and execute shell commands (the validation gates).
- Sanitization: Absent; there is no mention of sanitizing or escaping the diff content before it is processed by the agent.
Audit Metadata