code-format
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- COMMAND_EXECUTION (SAFE): The skill executes
dotnet formatandnpx prettiervia thescripts/format-all.shscript. These are legitimate development tools used according to their intended primary purpose of formatting source code. - EXTERNAL_DOWNLOADS (SAFE): The use of
npx prettiermay trigger a download of the Prettier package from the official npm registry. This is a standard behavior for the tool and does not represent an unverifiable or malicious dependency. - INDIRECT PROMPT INJECTION (SAFE): The skill processes project files for formatting. While it lacks explicit boundary markers for untrusted data, the capabilities are restricted to formatting tools which do not typically provide a path for code execution or exfiltration via injected instructions.
- Ingestion points: File paths passed via the
filesinput and glob patterns inscripts/format-all.sh. - Boundary markers: Absent; relies on the underlying tool's parser.
- Capability inventory: File system write access (in-place formatting), subprocess execution of
dotnetandnpx. - Sanitization: None; the tools themselves act as the sanitization layer by only performing structural code transformations.
Audit Metadata