prune-cruft
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data in the form of local source code files during the scanning phase, creating a surface for indirect prompt injection. Maliciously crafted code could contain instructions intended to manipulate the agent's behavior during analysis or modification. Ingestion points: File and directory scanning as described in SKILL.md (Steps 1 and 2). Boundary markers: Absent. Capability inventory: The skill has instructions to modify files and execute shell commands for build and verification in SKILL.md (Step 4). Sanitization: Absent.
- [COMMAND_EXECUTION]: The skill instructs the agent to run local build, lint, and test commands (such as 'tsc', 'cargo check', and 'go build') to verify the integrity of code after modifications. While these are standard development practices, they involve executing logic in the local shell environment. Evidence: SKILL.md (Step 4).
Audit Metadata