token-saver
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled Node.js script (
scripts/audit.mjs) to analyze the agent's environment and configuration. The script uses only core Node.js modules and is designed for read-only operation. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes the content of various local files (e.g.,
CLAUDE.md,AGENTS.md, and agent-specific configuration files) to generate optimization reports. - Ingestion points: The
scripts/audit.mjsscript reads multiple markdown, JSON, and TOML files from the project root and the user's home directory. - Boundary markers: No explicit delimiters or boundary markers are used when the content of these files is presented to the agent for analysis.
- Capability inventory: The skill has the ability to read project files and is instructed to propose and apply changes to configuration files based on audit results.
- Sanitization: The content of the audited files is not sanitized before being processed by the agent, which could allow maliciously crafted local files to influence the agent's behavior during an audit.
Audit Metadata