code-quality
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes source code and project structures provided by the user, which introduces a potential surface for indirect prompt injection. Maliciously crafted content within the analyzed files or specifically named files could attempt to influence the agent's behavior during the review process. \n
- Ingestion points: File system access and code content reading in Step 1 (Static Analysis), Step 4 (Code Smells), and Step 5 (Dead Code Detection). \n
- Boundary markers: No explicit boundary markers or safety instructions are defined to separate the skill's logic from the analyzed code. \n
- Capability inventory: The skill instructs the agent to execute multiple shell commands including ruff, pylint, mypy, radon, eslint, tsc, and mvn. \n
- Sanitization: There is no evidence of content sanitization or validation of the files before analysis. \n- [COMMAND_EXECUTION]: The skill requires the execution of several local CLI tools (ruff, pylint, mypy, radon, eslint, tsc, mvn) to gather metrics and identify issues. While these are standard development tools, the agent is directed to run them on the local environment.
Audit Metadata