lint-and-validate
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script scripts/lint_runner.py executes standard development tools (npm, ruff, mypy) using subprocess.run with fixed command arguments. This implementation follows the skill's intended purpose of project linting and minimizes command injection risks by avoiding shell execution and user-controlled strings in the command list.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes local source code files to report on type coverage and linting status, which introduces an indirect prompt injection surface. * Ingestion points: scripts/type_coverage.py reads file contents via Path.read_text. * Boundary markers: Absent. * Capability inventory: scripts/lint_runner.py can execute local commands. * Sanitization: None. Maliciously crafted code comments in a project could potentially influence the agent when it processes the resulting audit reports.
Audit Metadata