plan-dead-code
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes several standard CLI tools including
ripgrep(rg),npx,tsc, and thesupabaseCLI to perform static analysis and database metadata inspection. These tools are used within their intended scope for auditing repository health and dead code.\n- [EXTERNAL_DOWNLOADS]: The skill recommends installing and running well-known development tools such asknipandjscpdfrom official package registries. It also references a JSON schema fromunpkg.com, which is a recognized service for hosting package files.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to audit arbitrary source code and database schemas, creating a surface for indirect prompt injection if the audited files contain malicious instructions. However, the skill mitigates this risk through a strict 'Preservation Contract' that limits the agent to planning only, prohibits deletions, and instructs the agent to interpret tool findings as evidence rather than absolute truth.\n - Ingestion points: Source code files, repository configuration, and database schema metadata.\n
- Boundary markers: Explicit delimiters for ingested data are not required by the instructions.\n
- Capability inventory: Shell execution of auditing tools (
npx,rg,supabaseCLI,tsc).\n - Sanitization: No specific sanitization process is described for the content of audited files before interpretation.
Audit Metadata