dead-code-sweep
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local command line utilities (
uvx deadcode,uvx vulture,rg,uv run ruff,uv run pytest) to perform code scanning, text search, and test suite execution. These commands are standard operations aligned with the primary purpose of code maintenance and refactoring. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a potential indirect prompt injection surface because it analyzes codebase content which could contain untrusted data.
- Ingestion points: Code files within the target repository (
.,src/,tests/,scripts/,.github/) read viadeadcode,vulture, andrginSKILL.md. - Boundary markers: Absent; there are no instructions or system delimiters configured to tell the agent to ignore prompt-like instructions embedded in the scanned files or code comments.
- Capability inventory: Command execution via
uvx,rg, anduv runinSKILL.md. - Sanitization: Absent; raw tool output and grep matching text are fed directly back into the agent context.
Audit Metadata