cleanup-cycles
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs standard open-source developer utilities from official registries and repositories.
- Fetches
madgevia npm/bunx for JavaScript/TypeScript analysis. - Installs
pycycleandimport-lintervia pipx for Python analysis. - Installs
godafrom its official GitHub repository viago install. - Installs
cargo-modulesfrom crates.io viacargo install. - [COMMAND_EXECUTION]: Executes shell commands to perform project builds and run verification suites.
- Runs
go buildandcargo buildto confirm project integrity. - Executes project-defined scripts such as
bun run checkandpytestto verify refactorings. - Uses CLI tools like
madgeandpycycleto generate dependency reports in JSON or text formats. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it processes untrusted source code to guide its refactoring logic and command execution.
- Ingestion points: Reads local source code files (TS, JS, PY, GO, RS) during dependency analysis in
SKILL.md. - Boundary markers: No specific delimiters or instructions to ignore embedded content are present for the analyzed files.
- Capability inventory: The skill can create and modify files, and execute shell commands for builds and testing as seen in the
ApplyandVerifysections. - Sanitization: Does not explicitly sanitize file paths or content extracted from the dependency analysis before using them in file operations or shell commands.
Audit Metadata