Skip to content
Report library
Purpose / Development

Code Simplification Skill Security Audit

What the author says it does (original text)

Simplifies code for clarity. Use when refactoring code for clarity without changing behavior. Use when code works but is harder to read, maintain, or extend than it should be. Use when reviewing code that has accumulated unnecessary complexity.

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The recommended async simplification can change exception and Promise behavior

Source references: 3
What we found

The example replaces an async function with a regular function that directly returns the underlying call, despite the Skill requiring identical error behavior. If findById throws before returning a Promise, the original returns a rejected Promise while the rewritten function throws synchronously; Promise object identity can also differ. A declared Promise return type does not rule out these differences.

Why this matters

Callers' try/catch handling, Promise chains, retries, or error reporting may follow a different path, causing an unhandled exception, skipped recovery, or runtime interruption.

This is an explicitly recommended rewrite, but it may violate the Skill's own requirement to preserve error behavior. If `findById` throws synchronously before returning a Promise, the original `async` wrapper produces a rejected Promise, while the rewritten function throws synchronously; callers may therefore fail to catch it as before. Users can require this rewrite only when synchronous throws are ruled out and tests cover the distinction.

SKILL.md:32In the instructionsOpen original file
### 1. Preserve Behavior ExactlyDon't change what the code does — only how it expresses it. All inputs, outputs, side effects, error behavior, and edge cases must remain identical. If you're not sure a simplification preserves behavior, don't make it.
Show 2 other places
SKILL.md:192In the instructionsOpen original file
```typescript// SIMPLIFY: Unnecessary async wrapper// Beforeasync function getUser(id: string): Promise<User> {  return await userService.findById(id);}// Afterfunction getUser(id: string): Promise<User> {  return userService.findById(id);}
SKILL.md:34In the instructionsOpen original file
Don't change what the code does — only how it expresses it. All inputs, outputs, side effects, error behavior, and edge cases must remain identical. If you're not sure a simplification preserves behavior, don't make it.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

The workflow may create Git commits without confirmed authorization

Source references: 2
What we found

The per-change procedure explicitly says to “commit” after tests pass, but it does not require confirmation that the user authorized repository-history changes. A request to simplify code does not necessarily authorize the agent to create commits.

Why this matters

The agent may create an unwanted durable commit, alter branch history, and record refactoring that has not yet received human review.

This is an operative workflow instruction, not merely an example: after each passing test, the agent may `commit`, and the preceding text also directs separate refactoring submissions. A Git commit changes repository history, but these steps do not require confirming that the user authorized commits. A user who requested only refactoring could therefore receive an unexpected commit. Users can restrict the Skill to edits and tests and require separate approval before any commit.

SKILL.md:161In the instructionsOpen original file
```FOR EACH SIMPLIFICATION:1. Make the change2. Run the test suite3. If tests pass → commit (or continue to next simplification)4. If tests fail → revert and reconsider```
Show 1 other places
SKILL.md:159In the instructionsOpen original file
Make one simplification at a time. Run tests after each change. **Submit refactoring changes separately from feature or bug fix changes.** A PR that refactors and adds a feature is two PRs — split them.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill directs the agent to understand call relationships, error paths, tests, and historical context before incrementally refactoring recently modified code, while requiring inputs, outputs, side effects, and error behavior to remain unchanged.

View source
SKILL.md:34In the instructionsOpen original file
Don't change what the code does — only how it expresses it. All inputs, outputs, side effects, error behavior, and edge cases must remain identical. If you're not sure a simplification preserves behavior, don't make it.
SKILL.md:112In the instructionsOpen original file
```BEFORE SIMPLIFYING, ANSWER:- What is this code's responsibility?- What calls it? What does it call?- What are the edge cases and error paths?- Are there tests that define the expected behavior?- Why might it have been written this way? (Performance? Platform constraint? Historical reason?)- Check git blame: what was the original context for this code?```
SKILL.md:101In the instructionsOpen original file
### 5. Scope to What ChangedDefault to simplifying recently modified code. Avoid drive-by refactors of unrelated code unless explicitly asked to broaden scope. Unscoped simplification creates noise in diffs and risks unintended regressions.

It calls for making changes one at a time and running tests, while recommending that refactoring be submitted separately from features or bug fixes.

View source
SKILL.md:157In the instructionsOpen original file
### Step 3: Apply Changes IncrementallyMake one simplification at a time. Run tests after each change. **Submit refactoring changes separately from feature or bug fix changes.** A PR that refactors and adds a feature is two PRs — split them.```FOR EACH SIMPLIFICATION:1. Make the change2. Run the test suite3. If tests pass → commit (or continue to next simplification)4. If tests fail → revert and reconsider```
Start here · InstructionsSKILL.md
code-simplification
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:8In the instructionsOpen original file
> Inspired by the [Claude Code Simplifier plugin](https://github.com/anthropics/claude-plugins-official/blob/main/plugins/code-simplifier/agents/code-simplifier.md). Adapted here as a model-agnostic, process-driven skill for any AI coding agent.
Lines read
332
File checksum (to compare versions)
f2f1a31c6d13baa40d77841ad61dc10b353b8c017c74c893bf0d4e17a6a74deb