dry-refactoring

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFENO_CODEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill is purely instructional and provides a manual workflow for developers and AI agents to refactor code duplication. It does not contain any executable scripts, unexpected network calls, or hidden logic.
  • [NO_CODE]: The skill contains markdown documentation and workflow instructions but does not ship with any Python or JavaScript executable files or tool definitions.
  • [EXTERNAL_DOWNLOADS]: The instructions describe using npx jscpd to identify code clones. This refers to an established open-source tool maintained by the skill's author for code analysis purposes.
  • [COMMAND_EXECUTION]: The workflow instructs the use of npx jscpd with various CLI flags to analyze the local codebase for duplication hotspots.
  • [INDIRECT_PROMPT_INJECTION]: The workflow requires the agent to read and process source code from the local codebase to identify and refactor clones.
  • Ingestion points: The agent is instructed to read file contents and line ranges identified as clones into its context (Workflow step 3).
  • Boundary markers: The skill does not specify any specific delimiters or instructions to ignore potential commands embedded within the source code files being read.
  • Capability inventory: The workflow guides the agent to perform file reads, file writes (to apply refactorings), and shell command execution via the terminal.
  • Sanitization: The skill does not define methods for sanitizing or filtering the ingested source code before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 12:46 PM