improve-code-quality
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent or user to execute a shell command (
npx skills add wondelai/skills/<slug> --global) to install additional components required for specific phases of the journey. This is a mechanism for retrieving specialized tools from the author's own collection.\n- [EXTERNAL_DOWNLOADS]: The skill facilitates the acquisition of external modules from the author's (wondelai) repository to support its multi-phase analysis and refactoring tasks.\n- [PROMPT_INJECTION]: The skill utilizes an indirect prompt injection surface by reading from and writing to project documentation files to track progress across multiple sessions. The following assessment chain applies:\n - Ingestion points: The skill reads state information from
docs/IMPROVE-CODE-QUALITY-PLAN.md,docs/TESTING.md,docs/TECH-DEBT.md,docs/ARCHITECTURE.md, anddocs/RELIABILITY.md.\n - Boundary markers: There are no explicit delimiters or instructions to ignore potential commands embedded within these markdown files.\n
- Capability inventory: The skill possesses the ability to execute shell commands, write to the filesystem, and invoke other agent tools.\n
- Sanitization: The skill processes existing documentation content without explicit validation or escaping of the ingested text.
Audit Metadata