bundle-size-optimization
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data sources such as source code diffs, emitted JavaScript, and benchmark results which could potentially contain malicious instructions.
- Ingestion points: Found in SKILL.md under the 'Optimization Loop' and 'Attribution Round' sections, where the agent is instructed to analyze 'production diffs' and 'results/current.json'.
- Boundary markers: The instructions do not define specific delimiters or instructions for the agent to treat processed code as untrusted data.
- Capability inventory: The skill possesses the capability to execute shell commands via pnpm and spawn multiple subagents for review tasks.
- Sanitization: No explicit sanitization or validation of the ingested code or benchmark data is implemented.
- [COMMAND_EXECUTION]: The skill defines and uses multiple commands that execute repository-local scripts and tools through the pnpm package manager. These include 'benchmark:bundle-size:run', 'benchmark:bundle-size:query', and 'ts:symbol-references'. While these are standard development utilities, they represent a capability for local code execution within the agent's environment.
Audit Metadata