polish-before-commit
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several shell commands to identify project rules and files to process, including
findfor rule discovery,git difffor change detection, andgrep/rgfor pattern analysis and 'dead mock' identification. - [COMMAND_EXECUTION]: The skill runs language-specific linters and test runners such as
rubocop,eslint,ruff,black, andrspec. It also attempts to dynamically discover build and lint tasks from project files likeMakefile,package.json, andpyproject.tomlif the language is not predefined. - [SAFE]: The skill accesses the user's global configuration file located at
~/.claude/CLAUDE.mdto gather coding standards. While this is outside the project directory, it is used for its intended purpose of applying consistent coding rules and is a standard path for the platform. - [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes untrusted data from project files and follows instructions within
CLAUDE.mdand rules files. Ingestion points: Workflow steps readCLAUDE.md,.claude/rules/*.md,~/.claude/CLAUDE.md, and source code files. Boundary markers: Absent; the skill is instructed to follow instructions found in these external rule files. Capability inventory: The skill can execute shell commands (grep,rg, linters,rspec) and invoke sub-agents. Sanitization: Absent.
Audit Metadata