plankton-code-quality
Warn
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill installs multiple shell scripts (
multi_linter.sh,protect_linter_configs.sh,stop_config_guardian.sh) as hooks. These scripts run automatically during PreToolUse, PostToolUse, and Stop events, intercepting every file modification to perform linting and enforcement tasks. - [COMMAND_EXECUTION]: Implements command enforcement that actively blocks standard package managers such as
pip,npm,poetry, andyarnvia a PreToolUse hook on Bash commands. This redirects the agent or user to use specific alternatives likeuvorbun. - [COMMAND_EXECUTION]: The skill automatically spawns
gemini -psubprocesses to apply AI-powered fixes to source code. This recursive execution logic modifies files based on JSON-formatted violation data with varying timeouts and model tiers, often without displaying the intermediate steps to the primary agent. - [EXTERNAL_DOWNLOADS]: The skill relies on a large suite of external tools and binaries (e.g.,
jaq,ruff,uv,biome,shellcheck,hadolint,taplo,markdownlint-cli2). While these are common developer utilities, they must be installed from external sources for the skill to function, increasing the system's external dependency footprint.
Audit Metadata