ratchet-files
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute local JavaScript utilities (
check-file-size.mjs,install-git-hooks.mjs) using Node.js. These scripts are used to audit file sizes, identify splitting points, and install pre-commit hooks into the repository's configuration. - [EXTERNAL_DOWNLOADS]: Fetches the
linguist-languagespackage from the npm registry. This package is a standard utility used to recognize source code languages and is required for the skill's file analysis logic. - [INDIRECT_PROMPT_INJECTION]: The skill involves the agent reading and analyzing the content of source files within a repository to determine where they should be split into smaller units based on "concepts."
- Ingestion points: Untrusted source code files residing in the repository being analyzed.
- Boundary markers: None specified in the instructions for the content of analyzed files.
- Capability inventory: The skill can read/write files, modify git configuration/hooks, and install dependencies via package managers.
- Sanitization: No sanitization or filtering of file content is described before the agent processes the code for structural analysis.
Audit Metadata