complexity-optimizer
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled Python script
scripts/analyze_complexity.pyto perform static analysis on the target codebase. This script uses AST parsing and regular expressions to identify potential performance bottlenecks such as nested loops or N+1 queries without executing the scanned code. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data by reading and analyzing external source code from a user-provided repository.
- Ingestion points: The
scripts/analyze_complexity.pyscript reads the content of files with extensions like.py,.js,.ts, etc., from the target directory. - Boundary markers: The skill does not implement explicit delimiters or boundary markers when presenting the scanned code content to the agent, potentially allowing embedded malicious instructions to influence the agent's analysis.
- Capability inventory: The agent has the capability to generate reports and modify files in the codebase if requested by the user.
- Sanitization: While the scanner itself is a read-only static analysis tool, the LLM processing the findings could be susceptible to instructions hidden in code comments or strings (e.g., instructions to ignore specific hotspots or suggest incorrect 'optimizations').
Audit Metadata