Skills
Navigate
skills/obra/superpowers-lab/finding-duplicate-functions/Gen Agent Trust Hub

finding-duplicate-functions

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes multiple local shell scripts and relies on external system utilities including ripgrep (rg) and jq to parse the codebase.\n- [INDIRECT_PROMPT_INJECTION]: The skill extracts raw source code and implementation context from user-provided directories and interpolates this data directly into prompts for subagents (haiku and opus).\n
  • Ingestion points: scripts/extract-functions.sh reads source files from the user-specified directory.\n
  • Boundary markers: The prompt templates in scripts/categorize-prompt.md and scripts/find-duplicates-prompt.md lack explicit delimiters or instructions to ignore embedded instructions within the processed code snippets.\n
  • Capability inventory: The subagents are instructed to use the Write tool, and the environment supports shell execution and file system access.\n
  • Sanitization: Implementation context is included in prompts without escaping or validation, potentially allowing code comments containing malicious instructions to influence the agent's behavior.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 04:14 PM