flatten-fake-layers
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of
ts-morphandtsxvianpm install. These are well-known and reputable development packages used for TypeScript AST manipulation and script execution. - [COMMAND_EXECUTION]: The skill utilizes shell commands to manage dependencies, execute the analysis script, and run project-specific verification tools such as
tscand linters. These operations are necessary for the skill's documented purpose as a refactoring tool. - [PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface because it instructs the agent to read and analyze user-provided source code. If the code being analyzed contains malicious instructions, the agent could potentially be influenced.
- Ingestion points: TypeScript source files identified by the
find-fake-layers.mtsscript, specifically within function bodies and closures. - Boundary markers: The skill does not employ explicit delimiters or instructions for the agent to ignore directives embedded within the code snippets it reads.
- Capability inventory: The agent has the capability to modify the filesystem (deleting and inlining code) and execute build-related shell commands.
- Sanitization: No sanitization or filtering of the source code content is performed before it is presented to the agent for judgment.
Audit Metadata