ai-optimization
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructions and a utility script to help the agent manage token budgets by prioritizing relevant code and summarizing boilerplate. It operates locally on the project source code without performing network operations or unauthorized data exfiltration.
- [SAFE]: The Python script
scripts/context-sage.pyimplements static code analysis using standard library modules likeastandpathlib. It scans the local directory for source files and generates a markdown summary based on a relevance scoring algorithm. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code files which are then included in the agent's context. This is the primary function of the tool.
- Ingestion points: Source files with extensions like
.py,.ts, and.rsare read from the project root via thecontext-sage.pyscript and agent instructions. - Boundary markers: The generated context pack uses Markdown structure and file path headers to delineate contents.
- Capability inventory: The skill facilitates context enrichment; it does not invoke dynamic code execution or network operations on the ingested data.
- Sanitization: The skill implements token-saving compression and AST-based summarization but does not perform security-specific sanitization of the code content for potential injection patterns before it is passed to the LLM.
Audit Metadata