lsp-dead-code
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to execute search commands using the
greputility. This is intended to verify symbol references in wiring files and registration contexts that might be overlooked by static LSP analysis, ensuring accuracy before code removal. - [EXTERNAL_DOWNLOADS]: The documentation references the
agent-lsprepository on GitHub (github.com/blackwell-systems/agent-lsp) as a required component. This repository is maintained by the skill's author and serves as the primary provider for the LSP tools used in the analysis. - [PROMPT_INJECTION]: The skill processes untrusted code content and symbol identifiers, creating an indirect prompt injection surface. 1. Ingestion points: Symbol names and file paths via
mcp__lsp__list_symbols. 2. Boundary markers: Absent. 3. Capability inventory: Code deletion viamcp__lsp__safe_delete_symboland shell commands viagrep. 4. Sanitization: The skill mitigates risks by requiring manual verification and explicit user confirmation before any destructive actions are performed.
Audit Metadata