refactoring-patterns
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The SKILL.md file instructs the agent to run a shell command (ls) on specific local filesystem paths, such as ~/.claude/skills/ and ~/.agent/skills/, to identify existing companion skills.
- [EXTERNAL_DOWNLOADS]: The skill's instructions recommend the installation of additional tools from the AbsolutelySkilled repository using 'npx skills add', which facilitates the download and execution of remote code in the user's environment.
- [PROMPT_INJECTION]: As a tool for refactoring user-provided code, the skill exposes an indirect prompt injection surface where instructions embedded in code comments or data could influence the agent's behavior, particularly as it lacks explicit boundary markers or sanitization for input code.
Audit Metadata