clean-up
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to execute repository-level tools as part of its cleanup and verification workflow.
- Evidence: In
SKILL.md, step 2 instructs the agent to run "the repository's formatter, linter, type check, and tests for the touched code" if thecode-cleanupskill is unavailable. - Context: This is an expected behavior for a code cleanup tool, but it represents a capability that could be abused if the agent is influenced by malicious input.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external, potentially untrusted sources which could contain malicious instructions designed to manipulate the agent's file-writing or command-execution actions.
- Ingestion points: The skill collects requirements from "arguments", "session's requests", "linked issues", and the "PR description" (recorded in
SKILL.md, step 1). - Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are defined for the ingested data.
- Capability inventory: The agent has the ability to modify source code in one batch ("Fix clear findings", step 4) and execute shell commands ("formatter, linter, type check, and tests", step 2).
- Sanitization: No sanitization or validation of the ingested strings (PR descriptions, etc.) is mentioned before they are used to guide the cleanup and review process.
Audit Metadata