nullable-new-params

Pass

Audited by Gen Agent Trust Hub on Jul 15, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a bundled TypeScript script (scripts/find-new-optional-params.ts) to execute git diff via Bun.spawnSync. This is used to identify code changes and is a core part of the skill's intended functionality. The command is invoked safely using an array of arguments, which prevents shell injection.
  • [DATA_EXFILTRATION]: While the skill reads source code and git metadata, this data is processed locally to generate refactoring suggestions for the user. No network operations or external data transmissions were detected.
  • [EXTERNAL_DOWNLOADS]: The skill does not perform any external downloads or fetch remote resources. All logic is contained within the provided scripts and markdown instructions.
  • [PROMPT_INJECTION]: The instructions in SKILL.md are focused strictly on the task of refactoring TypeScript types and do not contain patterns aimed at bypassing AI safety filters or overriding system instructions.
  • [REMOTE_CODE_EXECUTION]: There is no evidence of remote code execution or the use of unsafe dynamic execution functions like eval() or exec() on untrusted data.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 15, 2026, 01:12 PM
Security Audit — agent-trust-hub — nullable-new-params