skills/qodesmith/skills/nuke-comments/Gen Agent Trust Hub

nuke-comments

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code comments which could contain malicious instructions. \n
  • Ingestion points: The agent reads source files within the repository to identify and classify comments as keepers or noise. \n
  • Boundary markers: The instructions do not define specific delimiters for separating the instructions from the data being analyzed. \n
  • Capability inventory: The agent has the ability to write to the filesystem and execute shell commands (linting, testing, and a verification script). \n
  • Sanitization: The verify-comments-only.sh script acts as a strong logical control by using esbuild to prove that only non-functional changes (comments/whitespace) occurred.\n- [EXTERNAL_DOWNLOADS]: The verify-comments-only.sh script utilizes package runners like npx, bunx, or pnpm dlx to execute esbuild. These tools may download the esbuild binary from public registries if it is not already cached locally.\n- [COMMAND_EXECUTION]: The workflow involves executing various local commands, including project test suites, linters, git grep for directive auditing, and the provided verify-comments-only.sh script for diff verification.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 10:59 AM