codepulse-deadcode
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests the entire codebase to perform its analysis, which exposes the agent to potentially malicious instructions embedded in source code or comments. This could be used to bias the findings or suppress the detection of specific code.\n
- Ingestion points: The skill uses the entire codebase as its context for analysis (SKILL.md).\n
- Boundary markers: No explicit delimiters or instructions are provided to help the agent distinguish between task instructions and the code being analyzed.\n
- Capability inventory: The skill reads codebase files and generates an HTML report stored in a local directory (SKILL.md).\n
- Sanitization: The instructions lack guidance on sanitizing code snippets before they are included in the HTML report, potentially leading to XSS if the generated report is opened in a browser.
Audit Metadata