code-quality
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill consists of high-quality, professional engineering guidelines and best practices based on established research (e.g., SonarSource, Clean Code, Knuth).
- [SAFE]: The 'Simplify' mode, which allows the agent to autonomously apply refactors, is protected by multiple safety gates: a 90% confidence threshold, scoped fast-checks (linting and type-checking), and a full test suite verification with automatic 'git checkout' reverts on any failure.
- [SAFE]: The skill uses internal agent orchestration patterns (invoking other skills like 'tdd' and 'ux') which is standard for specialized agent workflows.
- [INDIRECT_PROMPT_INJECTION]: As the skill is designed to process and refactor user-provided source code, it possesses a natural attack surface for indirect prompt injection. A malicious actor could theoretically embed instructions within code comments or string literals to influence the agent's behavior during the 'Simplify' or 'Review' passes. However, the risk is mitigated by the skill's strict reliance on mechanical refactor recipes and structural validation tools (tsc, lint, tests) which focus on code syntax and behavior rather than natural language instructions found in the processed data. (Severity: SAFE/LOW).
Audit Metadata