find-dead-code
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill defines a best-practice methodology for repository maintenance using established, reputable tools from the developer ecosystem. No malicious behaviors or security evasions were found.
- [COMMAND_EXECUTION]: The skill uses standard command-line tools such as
grepandpnpmto perform local static analysis and search operations. These operations are limited to the repository scope and are appropriate for identifying unused code paths. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze source code and configuration files, which are ingestion points for external data. While an attacker could theoretically embed instructions in a codebase to influence an agent's auditing logic, the skill encourages manual review and multiple verification steps, mitigating the risk.
- Ingestion points: Repository files including source code (.ts, .py, .go, .rs, .java) and configuration files (.json, .yaml).
- Boundary markers: None explicitly defined in the instructions.
- Capability inventory: Repository analysis via shell commands (
grep,pnpm), static analysis tool execution, and file deletion recommendations. - Sanitization: Relies on tool output and human-in-the-loop review of findings before deletion.
Audit Metadata