skill-dead-code-legacy
Warn
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill performs an audit of "Stale Configuration" by scanning .env files for variables that are not referenced elsewhere in the project. Accessing environment configuration files is a sensitive file path exposure.
- [COMMAND_EXECUTION]: The skill instructs the agent to use shell commands such as grep and git log to perform reachability analysis, search for imports, and determine the age of TODO markers via git history.
- [EXTERNAL_DOWNLOADS]: The documentation recommends running various auditing tools such as knip, depcheck, ts-prune, and jscpd via npx. These tools are fetched and executed from the NPM registry.
- [PROMPT_INJECTION]: The skill processes untrusted source code and configuration files, creating a surface for indirect prompt injection if the analyzed files contain malicious instructions.
- Ingestion points: Local project files, including source code (.ts, .py, .js, etc.), package.json, and .env files.
- Boundary markers: Absent; the skill does not provide instructions to distinguish between the analyzer's logic and instructions embedded within the codebase being scanned.
- Capability inventory: File system access, shell command execution (grep, git log), and report generation.
- Sanitization: Absent; the skill does not implement filtering or validation of the data ingested from the project files.
Audit Metadata