cleanup-slop
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs local file searches using
grepto identify specific comment patterns across multiple programming languages including TypeScript, Python, and Go. - [COMMAND_EXECUTION]: To verify that comment removal does not disrupt project tooling, the skill executes standard development commands such as
bunx biome,npx eslint, andruff. - [COMMAND_EXECUTION]: The skill attempts to run documentation generation scripts defined within the user's project (
npm run docs,bun run docs), which executes code defined in the project's own configuration. - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it reads and processes untrusted data from the local codebase to generate reports and determine deletion targets.
- Ingestion points: Source code files processed via
grepand read during the assessment phase. - Boundary markers: The skill does not define explicit delimiters or use specific 'ignore' instructions when the agent processes the content of the discovered comments.
- Capability inventory: The agent is authorized to modify files using the
Edittool and execute shell commands for linting and verification. - Sanitization: There is no evidence of sanitization or filtering of the comment content before it is processed by the agent to create the 'Critical Assessment' report.
Audit Metadata