fuck-u-code-analysis
Warn
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the global installation of the
eff-u-codepackage from the public npm registry. This package is not provided by a recognized trusted organization or a well-known service.\n- [COMMAND_EXECUTION]: The agent is instructed to runfuck-u-code analyze ., which executes a third-party binary with full read access to all files in the current working directory.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a process where the agent ingests data from a file generated by an external tool without security boundaries.\n - Ingestion points: The agent reads the results of the code analysis from
/tmp/fuc-report.json(SKILL.md, Step 2).\n - Boundary markers: The instructions do not include delimiters or specific guidance to treat the content of the JSON report as untrusted data.\n
- Capability inventory: The agent parses the metrics and locations from the report to generate actionable refactoring steps and a security concern report.\n
- Sanitization: There is no validation or sanitization of the JSON output before the agent processes it to decide on remediation actions.
Audit Metadata