skills/howells/skills/componentize/Gen Agent Trust Hub

componentize

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local analysis script, scripts/find-god-files.py, to identify code duplication and file complexity. It also utilizes standard command-line tools such as rg (ripgrep), sed, sort, and uniq for reconnaissance and pattern matching within the target codebase.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it is designed to ingest and process the contents of an external codebase.
  • Ingestion points: The skill reads source code files (.ts, .tsx, .js, .jsx) throughout the repository via rg and the find-god-files.py script (SKILL.md, scripts/find-god-files.py).
  • Boundary markers: There are no explicit instructions to the agent to disregard instructions or malicious prompts embedded within the source code comments or strings being analyzed.
  • Capability inventory: The skill has the capability to write to the filesystem, move files, create new packages, and execute local scripts (SKILL.md, references/package-extraction.md).
  • Sanitization: There is no specific evidence of sanitization, escaping, or filtering of the ingested source code content before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 07:03 AM
Security Audit — agent-trust-hub — componentize