flatten-fake-layers

Pass

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of ts-morph and tsx via npm install. These are well-known and reputable development packages used for TypeScript AST manipulation and script execution.
  • [COMMAND_EXECUTION]: The skill utilizes shell commands to manage dependencies, execute the analysis script, and run project-specific verification tools such as tsc and linters. These operations are necessary for the skill's documented purpose as a refactoring tool.
  • [PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface because it instructs the agent to read and analyze user-provided source code. If the code being analyzed contains malicious instructions, the agent could potentially be influenced.
  • Ingestion points: TypeScript source files identified by the find-fake-layers.mts script, specifically within function bodies and closures.
  • Boundary markers: The skill does not employ explicit delimiters or instructions for the agent to ignore directives embedded within the code snippets it reads.
  • Capability inventory: The agent has the capability to modify the filesystem (deleting and inlining code) and execute build-related shell commands.
  • Sanitization: No sanitization or filtering of the source code content is performed before it is presented to the agent for judgment.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 15, 2026, 08:13 AM
Security Audit — agent-trust-hub — flatten-fake-layers