remove-deadcode

Pass

Audited by Gen Agent Trust Hub on Jun 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes several shell commands to facilitate code cleanup, including bunx tsc for identification of unused locals, rm for file deletion, and git commands for committing changes. These commands are integral to the skill's stated purpose of refactoring code.
  • [EXTERNAL_DOWNLOADS]: Employs bunx to execute the TypeScript compiler, which may trigger a download of the typescript package from the official NPM registry if it is not found in the local environment.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes source code which may contain malicious instructions in comments or metadata. However, this risk is mitigated by mandatory technical verification steps, including LspFindReferences checks and full project typechecking/testing after each modification.
  • Ingestion points: Source code files in the src/ directory (SKILL.md).
  • Boundary markers: Uses LspFindReferences and bun run typecheck to validate all removal decisions.
  • Capability inventory: File deletion (rm), git management (git add, git commit), and command execution (bun run).
  • Sanitization: Changes are reverted if the build or typecheck fails.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 4, 2026, 11:45 AM
Security Audit — agent-trust-hub — remove-deadcode