deslop
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of branch diffs and source code files. An attacker could potentially embed malicious patterns in a Pull Request that trick the agent into removing security-critical code during the cleanup process.\n
- Ingestion points: The workflow reads branch diffs via
git diffand file contents viarg(ripgrep) as specified inSKILL.md.\n - Boundary markers: The skill includes a 'Guardrails' section that explicitly instructs the agent not to remove protections at trust boundaries (user input, auth, network, db, file I/O).\n
- Capability inventory: The skill utilizes the
Bashtool to execute shell commands and modify files.\n - Sanitization: No explicit programmatic sanitization is defined; the skill relies on the agent's adherence to the 'Slop checklist' and 'Guardrails'.\n- [COMMAND_EXECUTION]: The skill is configured to use the
Bashtool to execute several CLI tools.\n - Tools used:
git,rg(ripgrep), andbun(specificallybun checkandbun typecheck) are executed to inspect the repository and validate changes.\n - Risk factor: Commands are constructed based on repository metadata (e.g., branch names, file paths) which could be manipulated.
Audit Metadata