plankton-code-quality
Warn
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill configures
PreToolUseandPostToolUsehooks to execute arbitrary local shell scripts (multi_linter.sh,protect_linter_configs.sh,stop_config_guardian.sh) automatically whenever a file is modified. - [COMMAND_EXECUTION]: Implements command interception on the shell to block the use of legacy package managers such as
pip,poetry, andnpm, forcing the environment to useuvorbuninstead. - [REMOTE_CODE_EXECUTION]: Employs a 'Phase 3' delegation mechanism that spawns
claudesubprocesses to automatically rewrite code based on linter violations, which introduces automated, potentially unreviewed code changes. - [EXTERNAL_DOWNLOADS]: Requires the manual installation of a significant number of external dependencies and binaries (e.g.,
jaq,ruff,uv,biome,hadolint,taplo) from various third-party repositories. - [PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection where malicious content in files could trigger specific linter messages that influence the behavior of the automated fix subprocesses.
- Ingestion points: Linter violation messages (JSON format) processed in Phase 3.
- Boundary markers: Absent; structured JSON output from linters is passed directly to the model.
- Capability inventory: The subprocess agent has full file-edit capabilities to 'fix' code.
- Sanitization: Absent; no filtering of linter output is described before it is processed by the model.
Audit Metadata