stopslop
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the stopslop tool from the vendor's GitHub repository or the crates.io registry using cargo.
- [REMOTE_CODE_EXECUTION]: Provides a mechanism to install the Rust toolchain via the official rustup installer script when necessary.
- [INDIRECT_PROMPT_INJECTION]: Processes untrusted content from the project's files, creating a potential surface for instructions embedded in data to influence the agent.
- Ingestion points: Analyzes source code and documentation files within the repository (SKILL.md).
- Boundary markers: Results are captured in a structured JSON format (references/full-report.md).
- Capability inventory: Executes the stopslop tool and can perform file modifications based on user-marked fixes (references/render-and-fix.md).
- Sanitization: The skill uses a reporting and rendering pipeline that requires user interaction to approve any file changes.
Audit Metadata