plankton-code-quality
Warn
Audited by Gen Agent Trust Hub on Apr 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes PostToolUse and PreToolUse shell hooks to automatically execute scripts such as multi_linter.sh and protect_linter_configs.sh upon file modifications. It further spawns claude subprocesses to programmatically apply code fixes based on linter output.
- [COMMAND_EXECUTION]: The skill enforces specific package manager usage by intercepting and blocking legacy commands such as pip, npm, and yarn via a shell hook, representing an intervention in standard developer workflows.
- [EXTERNAL_DOWNLOADS]: The documentation directs users to install numerous external tools and linters including ruff, uv, biome, hadolint, shellcheck, and jaq from system package managers and official repositories.
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it ingests untrusted code from file edits and passes it to an AI subprocess for remediation.
- [PROMPT_INJECTION]: Ingestion points: Any file edited or written by the agent in the project directory as described in the Three-Phase Architecture. Boundary markers: Absent; there are no mentioned delimiters or instructions to ignore embedded content during Phase 3 delegation. Capability inventory: The skill can execute subprocesses, write to files, and run a variety of shell-based linting tools across multiple languages. Sanitization: Absent; the linter output is processed as JSON but the original source content being remediated is interpolated into the subprocess prompt.
Audit Metadata