remove-deadcode-py
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including project source code, configuration files, and git history, to identify and delete unused code. Maliciously crafted source code or metadata within the project could potentially influence the agent's logic during the identification phase.
- Ingestion points: Python source files (
.py), project configuration (pyproject.toml,setup.cfg,MANIFEST.in), git logs, and coverage reports. - Boundary markers: The skill does not define specific delimiters or instructions for the agent to ignore instructions embedded within the processed code files.
- Capability inventory: The skill executes static analysis tools (
ruff,vulture,deptry), search commands (grep), and version control operations (git commit,git checkout). - Sanitization: The skill implements a 'Guard List' to preserve code involving dynamic execution patterns (
eval,exec,getattr, etc.) and mandates running project tests and type checks after every deletion to ensure integrity. - [COMMAND_EXECUTION]: The skill instructs the agent to execute multiple command-line interface (CLI) tools for static analysis and file management, specifically
ruff,vulture,deptry,grep, andgit.
Audit Metadata