plan-dead-code

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes several standard CLI tools including ripgrep (rg), npx, tsc, and the supabase CLI to perform static analysis and database metadata inspection. These tools are used within their intended scope for auditing repository health and dead code.\n- [EXTERNAL_DOWNLOADS]: The skill recommends installing and running well-known development tools such as knip and jscpd from official package registries. It also references a JSON schema from unpkg.com, which is a recognized service for hosting package files.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to audit arbitrary source code and database schemas, creating a surface for indirect prompt injection if the audited files contain malicious instructions. However, the skill mitigates this risk through a strict 'Preservation Contract' that limits the agent to planning only, prohibits deletions, and instructs the agent to interpret tool findings as evidence rather than absolute truth.\n
  • Ingestion points: Source code files, repository configuration, and database schema metadata.\n
  • Boundary markers: Explicit delimiters for ingested data are not required by the instructions.\n
  • Capability inventory: Shell execution of auditing tools (npx, rg, supabase CLI, tsc).\n
  • Sanitization: No specific sanitization process is described for the content of audited files before interpretation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 05:12 AM
Security Audit — agent-trust-hub — plan-dead-code