reuse-first
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides various shell scripts that use
git,grep,xargs,sed, andawkto scan the project directory for duplicate literals and repeated phrases in code comments. - [EXTERNAL_DOWNLOADS]: Recommends the execution of
npx jscpd@5, which fetches and runs a tool from the official npm registry to perform structural code analysis. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local repository (source code and comments) to identify duplication, creating a minor injection surface.
- Ingestion points: Local codebase, specifically string literals and developer comments parsed via
git diffandgrep(SKILL.md). - Boundary markers: None present in the shell command pipelines.
- Capability inventory: The skill uses
git,grep, and a package runner (npx) to analyze and output findings (SKILL.md). - Sanitization: Extracted text from comments is processed and displayed without explicit escaping or filtering.
Audit Metadata