Dead Code Eliminator
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to analyze external codebase content and production telemetry, which are untrusted inputs. This creates a surface where malicious instructions embedded in code comments, metadata, or logs could theoretically influence the agent's behavior during the deletion process.
- Ingestion points: The agent reads source code files, dependency graphs, and production telemetry logs (SKILL.md workflow steps 2, 3, and 4).
- Boundary markers: The instructions do not specify any delimiters or safety markers to differentiate between the agent's instructions and the content of the files being analyzed.
- Capability inventory: The agent has the capability to run static analysis tools, search the filesystem (grep), and generate pull requests to delete code, tests, and configuration files.
- Sanitization: There are no instructions for sanitizing or filtering the content read from the codebase or telemetry before processing.
Audit Metadata