anti-slop
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes npx to download and run the @gessobuild/anti-slop utility. This package is maintained by the skill's authoring organization and is necessary for the skill's operation.\n- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to analyze and modify local files. This is consistent with its role as a code quality and design tool.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external HTML/CSS files, creating a potential surface for indirect prompt injection.\n
- Ingestion points: Local files and directories processed by the check and fix commands in SKILL.md.\n
- Boundary markers: The skill includes a specific security rule (Hard Rule 6) warning that scanned documents are untrusted input and that their content should not be followed as instructions.\n
- Capability inventory: The skill has the capability to execute shell commands via npx and write to files using the fix --write command.\n
- Sanitization: The documentation states that the tool performs static analysis (regex and parsing) and does not execute the target HTML code.
Audit Metadata