custom-linter-creator
Warn
Audited by Gen Agent Trust Hub on Mar 3, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the execution of several system-level commands to build and run linters. This includes
cargo dylint --allfor Rust,npx eslint .for TypeScript,pylintfor Python, andgo buildfollowed by binary execution for Go. - [REMOTE_CODE_EXECUTION]: The core workflow involves generating source code (e.g.,
.rs,.js,.py,.gofiles) that implements linting logic and then executing that code. For Rust and Go, the skill compiles this agent-generated code into libraries or binaries which are dynamically loaded and executed by the linter framework. - [PROMPT_INJECTION]: The skill is specifically designed to output "AI-friendly" error messages that function as instructions for the agent to modify the codebase. This creates an indirect prompt injection vector where malicious or poorly defined rules could trick the agent into performing harmful code modifications during the automated fix process.
- [EXTERNAL_DOWNLOADS]: To function, the skill guides the agent to add and download dependencies from public registries. These include
dylint_lintingandclippy_utilsfrom crates.io,eslintfrom npm, andpylintfrom PyPI. These are well-known tools within their respective ecosystems.
Audit Metadata