clean-code
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [SAFE]: The skill provides purely instructional content and frameworks for improving code quality. No executable code, remote scripts, or unauthorized network operations were identified across any of the files.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and refactor user-provided code, which represents an untrusted data ingestion point. However, the skill acts solely as an instructional guide and does not possess capabilities that could be maliciously leveraged through injection.
- Ingestion points: User-supplied code provided for review or refactoring (SKILL.md).
- Boundary markers: The instructions do not define specific delimiters for separating user-supplied code from the agent's instructions.
- Capability inventory: The skill is restricted to generating textual analysis and does not involve subprocess calls, file-system modifications, or network activities.
- Sanitization: No sanitization or input validation for the processed code is implemented.
- [METADATA_POISONING]: There is a minor discrepancy between the skill author listed in the metadata ("wondelai") and the official vendor context ("jd-solanki"). Additionally, the documentation includes Amazon affiliate links associated with the metadata author. These findings are noted for transparency but do not pose a security threat.
Audit Metadata