codebase-health-auditor
Warn
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill uses 'Claude Code' as its author name in the SKILL.md and package.json files, which is an attempt to impersonate the platform provider. This is inconsistent with the verified author 'endlessblink' and may lead to an incorrect assessment of the skill's safety.
- [COMMAND_EXECUTION]: The documentation in 'references/systematic-refactoring.md' instructs the agent to execute shell commands such as 'lsof -ti:5550 | xargs kill -9' to terminate local processes, which could disrupt the user's environment.
- [PROMPT_INJECTION]: The skill's description and documentation claim support for 'execute' commands and various code detectors (e.g., unused exports, Vue dead code) that are not actually present in the provided scripts.
- [COMMAND_EXECUTION]: The skill's primary command-line interface suggests and documents a file-modifying '--execute' flag, yet the 'orchestrator.js' script provided has no implementation for this functionality.
Audit Metadata