deslop
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to run local git commands to identify modified code.
- The instructions in
SKILL.mdspecify usinggit merge-base HEAD origin/HEADto determine the scope of changes for cleanup. - [INDIRECT_PROMPT_INJECTION]: The skill processes source code which may originate from untrusted sources or other AI agents, creating a potential surface for indirect injection.
- Ingestion points: The agent reads FiveM resource code (Lua, TypeScript, JavaScript) as defined in the 'Scope' section of
SKILL.md. - Boundary markers: The skill does not define explicit boundary markers for the code being processed, although it focuses cleanup only on lines introduced in the current diff.
- Capability inventory: The agent has the capability to read project files and apply modifications (write) to the file system.
- Sanitization: No explicit sanitization of the input code is performed, as the skill's primary function is to interpret and refactor code structure; however, the 'Never remove' section provides robust logical guardrails for maintaining security checks.
Audit Metadata