rp-refactor-cli
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the 'rp-cli' tool to execute various shell-based commands for file system exploration and code manipulation. Commands like 'tree', 'search', 'read', 'apply_edits', and 'file_actions' provide the agent with broad access to the local workspace. These commands are executed via shell invocation (rp-cli -e '...'), which is the primary intended function of this CLI-based skill.
- [PROMPT_INJECTION]: The skill is susceptible to both direct and indirect prompt injection.
- Direct Injection: The prompt interpolates user input using the '$ARGUMENTS' variable, which can be exploited to override agent instructions.
- Indirect Injection: The skill reads and processes external codebase content which could contain malicious instructions designed to influence the agent's behavior during analysis or implementation phases.
- Ingestion points: Workspace content enters the context through 'rp-cli' commands such as 'read', 'search', and 'tree' as documented in 'SKILL.md'.
- Boundary markers: The instructions lack explicit delimiters or markers to isolate code content from instructions when processing findings via the 'builder' tool.
- Capability inventory: The skill has the capability to modify the local filesystem ('apply_edits', 'file_actions') and execute arbitrary shell commands via the 'rp-cli' interface.
- Sanitization: There is no evidence of sanitization, filtering, or validation of ingested code content before it is processed by the agent.
Audit Metadata