clean-user-facing-text

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses local Python scripts (clean_text.py, inspect_text.py) for deterministic text processing. These scripts are invoked with user-provided file paths but utilize standard library arguments and safe path handling via pathlib, presenting no risk of arbitrary command injection.
  • [DATA_EXFILTRATION]: There are no network operations, external API calls, or hidden data transfer mechanisms. File operations are confined to the local filesystem, with logic explicitly checking for and refusing to write through symlinks to prevent directory traversal or unauthorized file overwriting.
  • [OBFUSCATION]: The core purpose of the skill is to identify and remove Unicode-based obfuscation techniques, such as zero-width characters, homoglyphs, and hidden tag characters. The skill's own source code, metadata, and instructions contain no obfuscation, encoding, or hidden logic.
  • [DYNAMIC_EXECUTION]: The implementation avoids all forms of dynamic code execution. It does not use eval(), exec(), or dynamic module loading. The logic is deterministic and restricted to string manipulation and Unicode normalization.
  • [SAFE]: The skill includes robust defensive features, including binary content sniffing to prevent processing of non-text containers, and hardcoded input size limits (256MB for files, 64MB for stdin) to protect against resource exhaustion attacks.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 10:34 AM