repo-cleanup

Warn

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs file system and repository management using commands like rm -rf to clear build artifacts and git push origin --delete to remove remote branches as part of the archival process.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes npx to fetch and run several development utilities from the npm registry, including ts-prune, depcheck, unimported, license-checker, and webpack-bundle-analyzer.
  • [REMOTE_CODE_EXECUTION]: Runtime execution of tools is facilitated via npx for analysis tasks.
  • [CREDENTIALS_UNSAFE]: The cleanup routines include patterns for identifying and moving environment-related files such as .env.backup and .env.old.
  • [DYNAMIC_EXECUTION]: The skill demonstrates the use of find and sed to automate code refactoring and import updates during test migrations.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The agent reads codebase documentation and source files (via Read and Glob) to categorize them for cleanup or archival.
  • Boundary markers: None identified in the instruction templates.
  • Capability inventory: The skill possesses capabilities for file removal (rm), movement (mv), and external tool execution (npx).
  • Sanitization: No specific content filtering is mentioned before the agent makes cleanup decisions based on file content.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 15, 2026, 05:36 AM
Security Audit — agent-trust-hub — repo-cleanup