cleanup-cycles
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various system commands for dependency analysis (
madge,pycycle), project building (go build,cargo build), and validation (pytest,npm run check,eslint). These executions are core to the skill's purpose of detecting cycles and verifying that refactors do not introduce regressions. - [EXTERNAL_DOWNLOADS]: Fetches and installs analysis tools from public package registries and GitHub repositories, including
madge,pycycle,cargo-modules, andgoda. These downloads are used to provide the necessary tooling for the dependency graph analysis across different programming languages. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it processes and refactors untrusted source code files.
- Ingestion points: Reads local project source files through various static analysis tools.
- Boundary markers: No specific delimiters are used when the agent processes the code content for refactoring.
- Capability inventory: Authorized to write new files to the filesystem and execute shell commands for building and testing.
- Sanitization: The risk is mitigated by a confidence rubric that limits automated fixes to simple 2-module cycles involving small utilities and types, requiring human review for more complex architectural changes.
Audit Metadata