clean-room-loop
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of a project-local utility using
npx clean-room-skill@latest --claude --local --yes, which fetches the package from the npm registry at runtime.- [REMOTE_CODE_EXECUTION]: The initialization process involves executing theclean-room-skillpackage via the shell to write and set up local workflow scripts.- [COMMAND_EXECUTION]: The skill utilizes theWorkflow()function to execute project-local Javascript files (clean-room-loop.js) stored in the.claude/workflows/directory.- [PROMPT_INJECTION]:\n - Ingestion points: User-provided inputs, including the
endGoal,targetStack, and various feature/dependency policies, are collected and passed as arguments to the background workflow (SKILL.md).\n - Boundary markers: Arguments are passed as a structured object to the
Workflowcall, but the skill does not define specific delimiters or instructions to prevent the subagents from obeying commands embedded within the user-provided goal strings (SKILL.md).\n - Capability inventory: The underlying workflow has access to the file system (reading source roots and writing artifacts), manages shell commands, and spawns multiple in-session subagents (SKILL.md).\n
- Sanitization: No explicit sanitization or validation of the user-provided goals and stack descriptions is described before the data is processed by the agent roles (SKILL.md).
Audit Metadata