codemod
Pass
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: LOW
Full Analysis
- SAFE (SAFE): A thorough audit of the 53 files, including 48 rule definitions and associated metadata, confirms the skill is purely instructional and contains no malicious patterns, prompt injections, or data exfiltration vectors.
- Security-First Design (INFO): The skill includes a dedicated 'Security and Capabilities' section (prefix
security-) which provides explicit defensive instructions for agents, including: - Minimizing requested capabilities in
codemod.yamlto reduce attack surface. - Sanitizing and validating external inputs before use in AST patterns or shell commands.
- Reviewing third-party code for warning signs like obfuscation or unnecessary permissions.
- Implementing file ownership checks to prevent unauthorized modification of external dependencies or system files.
Audit Metadata