cleanup-slop

Pass

Audited by Gen Agent Trust Hub on Jun 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill employs grep commands to scan project source files (TypeScript, Python, JavaScript, Go, Rust) for specific comment patterns labeled as 'slop' or 'narration'.
  • [COMMAND_EXECUTION]: After performing comment deletions, the skill executes common development linting and formatting tools such as biome, eslint, and ruff to ensure code integrity. It also attempts to run project-defined documentation scripts (npm run docs, bun run docs) to verify that no essential documentation markers were removed.
  • [EXTERNAL_DOWNLOADS]: The verification process utilizes npx and bunx to run linters, which is a standard procedure in JavaScript/TypeScript development environments.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data (source code comments) which could theoretically contain malicious instructions.
  • Ingestion points: Project files with extensions .ts, .tsx, .py, .js, .go, and .rs.
  • Boundary markers: None specified for the read operations.
  • Capability inventory: The skill is restricted to comment-line removal via the Edit tool, local report generation, and running standard development linters.
  • Sanitization: The skill uses targeted regex patterns and limits its actions strictly to comment lines, never touching executable code logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 28, 2026, 12:34 AM
Security Audit — agent-trust-hub — cleanup-slop