lint
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to execute local CLI tools for linting and formatting, such as
eslint,ruff,gofmt, andcargo clippy. These commands are run against the project's source code to detect or fix style issues, which is the stated and intended purpose of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources, specifically the output of linting tools and the content of project configuration files (e.g.,
package.json,Makefile). - Ingestion points: Linter output and project configuration files are read into the agent context in SKILL.md.
- Boundary markers: The skill does not explicitly define boundary markers or instructions to ignore embedded content within the linter output.
- Capability inventory: The skill uses shell commands to run linters but does not possess network or sensitive file-write capabilities.
- Sanitization: No specific sanitization of tool output is mentioned.
- [SAFE]: No evidence of data exfiltration, obfuscation, persistence mechanisms, or credential harvesting was found. The skill follows developer best practices by prioritizing project-defined tasks over raw tool calls.
Audit Metadata