cleanup-cycles

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes various system commands for dependency analysis (madge, pycycle), project building (go build, cargo build), and validation (pytest, npm run check, eslint). These executions are core to the skill's purpose of detecting cycles and verifying that refactors do not introduce regressions.
  • [EXTERNAL_DOWNLOADS]: Fetches and installs analysis tools from public package registries and GitHub repositories, including madge, pycycle, cargo-modules, and goda. These downloads are used to provide the necessary tooling for the dependency graph analysis across different programming languages.
  • [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it processes and refactors untrusted source code files.
  • Ingestion points: Reads local project source files through various static analysis tools.
  • Boundary markers: No specific delimiters are used when the agent processes the code content for refactoring.
  • Capability inventory: Authorized to write new files to the filesystem and execute shell commands for building and testing.
  • Sanitization: The risk is mitigated by a confidence rubric that limits automated fixes to simple 2-module cycles involving small utilities and types, requiring human review for more complex architectural changes.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 06:16 AM
Security Audit — agent-trust-hub — cleanup-cycles