knip-dead-code
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze project files, including source code and configuration files, which are external and untrusted inputs. This creates a vulnerability surface where instructions embedded in comments or strings within the analyzed code could potentially influence the agent's behavior during cleanup or analysis tasks.
- Ingestion points: Source files (.ts, .js), configuration files (knip.json, knip.ts), and package manifests (package.json) accessed via the Read and Glob tools.
- Boundary markers: The skill does not define specific markers or instructions to isolate analyzed code content from the agent's instruction set.
- Capability inventory: The agent has access to the Bash tool for running CLI commands and the Edit/Write tools for modifying files.
- Sanitization: No explicit sanitization or validation of the code content is mentioned before the agent processes it.
- [COMMAND_EXECUTION]: The skill facilitates the execution of the knip CLI tool using bunx. This is a standard workflow for performing static analysis on JavaScript and TypeScript projects to identify unused code and dependencies.
Audit Metadata