vulture-dead-code

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill operates on local source code, which represents a surface for indirect prompt injection if analyzed files contain malicious instructions.
  • Ingestion points: Python source files are read using Read and Glob tools and analyzed by vulture and deadcode via Bash commands.
  • Boundary markers: The documentation does not specify the use of delimiters or instructions to ignore embedded commands within the analyzed code.
  • Capability inventory: The skill possesses the Bash tool for command execution and Read for accessing file contents.
  • Sanitization: No explicit sanitization or filtering is performed on the content of the analyzed files.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of common Python development tools from official package registries.
  • Evidence: The skill includes instructions to install packages using uv add --dev vulture deadcode and references official repositories for pre-commit hooks.
  • [COMMAND_EXECUTION]: The skill utilizes shell commands to execute code analysis and manage dependencies.
  • Evidence: Instructions include running vulture, deadcode, and uv commands within the project environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 02:13 AM