keep-codebase-maintainable

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use common CLI tools including git, grep, knip, ts-prune, and depcheck to identify and remove unused code. These instructions are focused on maintainability and surgical diff management.
  • [EXTERNAL_DOWNLOADS]: The reference file references/instances.md identifies https://api.hindsight.vectorize.io as the source API for the maintainability examples. This reference is for data provenance and does not include automated downloading or execution of remote scripts.
  • [INDIRECT_PROMPT_INJECTION]: The skill operates by analyzing and modifying external codebases, which constitutes an indirect prompt injection surface.
  • Ingestion points: Files within the target codebase being cleaned (specified in SKILL.md rules).
  • Boundary markers: Absent; the skill does not define specific delimiters for separating codebase content from instructions.
  • Capability inventory: Subprocess calls for git operations, grep searches, and execution of external node-based analysis tools (SKILL.md).
  • Sanitization: Present; the skill mandates multi-step verification, including mandatory grep checks and validation of live consumers for infrastructure-related resources to prevent accidental deletion.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 12:51 AM
Security Audit — agent-trust-hub — keep-codebase-maintainable