unslop
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as a transparent operational guide for the 'unslop' CLI tool. The instructions and workflow are consistent with the stated purpose of post-processing AI-generated text to improve quality.
- [EXTERNAL_DOWNLOADS]: The skill guides the user through installing the 'unslop' package using standard Python tools like 'pipx' or 'uv'. This is an expected and benign dependency for a CLI-based workflow skill.
- [SAFE]: The documentation includes explicit security notes that warn about potential API key usage in non-deterministic modes. It recommends using the '--deterministic' flag for processing sensitive local files to ensure privacy and avoid unnecessary network calls to LLM providers.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted user-provided prose through a shell-based CLI tool.
- Ingestion points: User text is ingested via stdin in commands like
echo "..." | unslop --stdinorcat draft.md | unslop. - Boundary markers: No specific boundary markers are used in the command examples, which is standard for local shell pipe utilities.
- Capability inventory: The skill utilizes shell capabilities for package management (pipx, uv) and file/stream operations (cat, echo, mv, redirection).
- Sanitization: The 'unslop' tool itself performs the sanitization by programmatically removing specific AI writing patterns from the input text.
- [SAFE]: Comprehensive provenance is provided in 'ORIGIN.md', correctly identifying the source repository and commit hash. The skill maintains transparency regarding its origin and authorship.
Audit Metadata