codebase-optimization
Pass
Audited by Gen Agent Trust Hub on Feb 15, 2026
Risk Level: LOWPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION] (LOW): The skill possesses an indirect injection surface as it is designed to ingest and analyze untrusted codebase content. Evidence: 1. Ingestion points: Analyzes *.ts, *.js, and *.tsx files as defined in references/validations.md. 2. Boundary markers: Absent in SKILL.md. 3. Capability inventory: None; the skill contains no scripts with file-write, network, or subprocess capabilities. 4. Sanitization: Absent.
- [METADATA_POISONING] (LOW): SKILL.md references a missing file (references/sharp_edges.md) as a source of truth for diagnosis, which could lead to incomplete or inaccurate reasoning.
- [DATA_EXFILTRATION] (SAFE): No access to sensitive file paths (~/.ssh, .env) or unauthorized network operations were identified.
- [REMOTE_CODE_EXECUTION] (SAFE): No remote script execution patterns (curl|bash) or unverifiable package installations are present.
Audit Metadata