code-style
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled helper shell script (scripts/style-scope.sh) to identify the set of changed files and search for project-specific formatting configurations and style documentation. This script is read-only and interacts with the local git environment.
- [COMMAND_EXECUTION]: Instructions guide the agent to invoke established, local development tools such as npx prettier, npx eslint, ruff, and gofmt to automate code formatting and linting.
- [SAFE]: The skill processes the user's codebase and neighbor files to learn stylistic conventions. While this constitutes an indirect prompt injection surface by ingesting untrusted data, the instructions strictly constrain the agent to extract only stylistic, naming, and structural patterns, mitigating the risk of following malicious instructions embedded in the code. Evidence Chain: (1) Ingestion points: local codebase and project documentation (e.g., CLAUDE.md); (2) Boundary markers: instructions focused exclusively on style, naming, and idioms; (3) Capability inventory: file-write operations and execution of local development tools; (4) Sanitization: implicit through the use of specific style-based extraction rules.
Audit Metadata