componentize
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local analysis script,
scripts/find-god-files.py, to identify code duplication and file complexity. It also utilizes standard command-line tools such asrg(ripgrep),sed,sort, anduniqfor reconnaissance and pattern matching within the target codebase. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it is designed to ingest and process the contents of an external codebase.
- Ingestion points: The skill reads source code files (.ts, .tsx, .js, .jsx) throughout the repository via
rgand thefind-god-files.pyscript (SKILL.md, scripts/find-god-files.py). - Boundary markers: There are no explicit instructions to the agent to disregard instructions or malicious prompts embedded within the source code comments or strings being analyzed.
- Capability inventory: The skill has the capability to write to the filesystem, move files, create new packages, and execute local scripts (SKILL.md, references/package-extraction.md).
- Sanitization: There is no specific evidence of sanitization, escaping, or filtering of the ingested source code content before it is processed by the agent.
Audit Metadata