remove-deadcode
Pass
Audited by Gen Agent Trust Hub on Jun 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several shell commands to facilitate code cleanup, including
bunx tscfor identification of unused locals,rmfor file deletion, andgitcommands for committing changes. These commands are integral to the skill's stated purpose of refactoring code. - [EXTERNAL_DOWNLOADS]: Employs
bunxto execute the TypeScript compiler, which may trigger a download of thetypescriptpackage from the official NPM registry if it is not found in the local environment. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes source code which may contain malicious instructions in comments or metadata. However, this risk is mitigated by mandatory technical verification steps, including
LspFindReferenceschecks and full project typechecking/testing after each modification. - Ingestion points: Source code files in the
src/directory (SKILL.md). - Boundary markers: Uses
LspFindReferencesandbun run typecheckto validate all removal decisions. - Capability inventory: File deletion (
rm), git management (git add,git commit), and command execution (bun run). - Sanitization: Changes are reverted if the build or typecheck fails.
Audit Metadata