dead-code-cleanup
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands through restricted Bash environments (e.g.,
npm,pnpm,go,git status) to detect project types and verify code integrity. It executes user-defined or project-standard build and test scripts (e.g.,npm run build,go test ./...) as a necessary part of the validation workflow to ensure that deletions do not break the codebase. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill performs read operations on project files and configuration metadata (like
package.jsonandgo.mod) to map dependencies and export surfaces. This data access is localized to the project environment and is essential for its primary function of identifying unused code; no external exfiltration patterns were detected. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project source code and comments (e.g., scanning for
@deprecatedorTODOtags). While this presents a theoretical attack surface where malicious comments could attempt to influence the agent, the skill defines strict verification loops and preservation rules that significantly mitigate the risk of unintended actions. (Severity: LOW).
Audit Metadata