vulture-dead-code
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates on local source code, which represents a surface for indirect prompt injection if analyzed files contain malicious instructions.
- Ingestion points: Python source files are read using
ReadandGlobtools and analyzed byvultureanddeadcodeviaBashcommands. - Boundary markers: The documentation does not specify the use of delimiters or instructions to ignore embedded commands within the analyzed code.
- Capability inventory: The skill possesses the
Bashtool for command execution andReadfor accessing file contents. - Sanitization: No explicit sanitization or filtering is performed on the content of the analyzed files.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of common Python development tools from official package registries.
- Evidence: The skill includes instructions to install packages using
uv add --dev vulture deadcodeand references official repositories for pre-commit hooks. - [COMMAND_EXECUTION]: The skill utilizes shell commands to execute code analysis and manage dependencies.
- Evidence: Instructions include running
vulture,deadcode, anduvcommands within the project environment.
Audit Metadata