cleanup-unused
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to perform repository analysis and maintenance. These include running scanners (knip, vulture, staticcheck), deleting files via 'rm', modifying source code using 'Edit' keywords, managing packages (pip, bun, cargo), and committing changes with 'git commit'.
- [EXTERNAL_DOWNLOADS]: Fetches and installs development utilities from well-known package registries and official tool sites. This includes 'knip' (npm), 'vulture' (PyPI), 'staticcheck' (Go), and 'cargo-machete' (Cargo).
- [PROMPT_INJECTION]: Evaluated the surface for indirect prompt injection where untrusted data within a repository might attempt to manipulate the automated deletion logic during tool output parsing.
- Ingestion points: Analysis reports generated in SKILL.md (e.g., /tmp/knip.json, /tmp/vulture.json, /tmp/staticcheck.txt).
- Boundary markers: No explicit delimiters or instructions are used to separate tool output from the agent's logic.
- Capability inventory: File system access (rm), dependency uninstallation, and git repository modification described in SKILL.md.
- Sanitization: The skill performs independent verification using 'grep' to confirm zero references before auto-applying deletions and utilizes build/test suites as a verification gate before finalizing changes.
Audit Metadata