cmd-sculpt-code
Pass
Audited by Gen Agent Trust Hub on Apr 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a legitimate utility for code quality improvement and refactoring. It relies on standard developer workflows, including git diff analysis and grep-based searching, to identify code segments for modification.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted source code from the local filesystem to perform its refactoring tasks, representing a surface for potential instruction injection. Ingestion points: Reading source files and git diff outputs as specified in the SKILL.md instructions. Boundary markers: None; the skill does not use specific delimiters to separate code content from agent instructions. Capability inventory: The agent has the ability to read local source files and directly apply code modifications. Sanitization: No explicit sanitization or filtering logic is implemented to prevent the agent from potentially reacting to instructions embedded within comments or strings in the processed code.
Audit Metadata