no-invalid-states
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill primarily consists of instructional content, providing technical strategies for implementing 'parse, don't validate' patterns and improving type safety. All external references and links point to the author's official GitHub repositories and personal website.
- [COMMAND_EXECUTION]: The instructions direct the agent to run existing local verification tools such as
cargo test,npm test,pytest, and various linters. These actions are performed to validate that refactored code still meets the repository's own requirements and do not involve executing untrusted remote scripts. - [INDIRECT_PROMPT_INJECTION]: As the skill is designed to analyze and modify source code, it naturally ingests external data. While this represents a theoretical attack surface for indirect prompt injection, the risk is inherent to the tool's primary purpose and is mitigated by the instruction to rely on the project's own static analysis and testing suites for verification.
Audit Metadata