dry-refactoring
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFENO_CODEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is purely instructional and provides a manual workflow for developers and AI agents to refactor code duplication. It does not contain any executable scripts, unexpected network calls, or hidden logic.
- [NO_CODE]: The skill contains markdown documentation and workflow instructions but does not ship with any Python or JavaScript executable files or tool definitions.
- [EXTERNAL_DOWNLOADS]: The instructions describe using
npx jscpdto identify code clones. This refers to an established open-source tool maintained by the skill's author for code analysis purposes. - [COMMAND_EXECUTION]: The workflow instructs the use of
npx jscpdwith various CLI flags to analyze the local codebase for duplication hotspots. - [INDIRECT_PROMPT_INJECTION]: The workflow requires the agent to read and process source code from the local codebase to identify and refactor clones.
- Ingestion points: The agent is instructed to read file contents and line ranges identified as clones into its context (Workflow step 3).
- Boundary markers: The skill does not specify any specific delimiters or instructions to ignore potential commands embedded within the source code files being read.
- Capability inventory: The workflow guides the agent to perform file reads, file writes (to apply refactorings), and shell command execution via the terminal.
- Sanitization: The skill does not define methods for sanitizing or filtering the ingested source code before it is processed by the agent.
Audit Metadata