refactor-backend-01-architecture

Pass

Audited by Gen Agent Trust Hub on Jul 6, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes standard build and version control commands (mvn, gradle, git mv, mv) to refactor the project structure and verify the build status as part of its primary function.
  • [COMMAND_EXECUTION]: Executes a local orchestration script located at ~/.claude/skills/refactor-chain/scripts/orchestrate.mjs. This script is used to manage state transitions within the multi-step refactoring pipeline.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests untrusted data from the user's codebase (build files and Java source).
  • Ingestion points: Reads content from pom.xml, build.gradle, .java, and configuration files (.yml, .properties).
  • Boundary markers: None explicitly defined to separate file content from instructions.
  • Capability inventory: Includes file read/write, file deletion, and shell command execution (mvn, gradle, node).
  • Sanitization: None detected; however, the skill's instructions strictly limit the scope of edits to structural metadata (imports, package declarations), specifically forbidding modification of method bodies.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 6, 2026, 01:01 AM
Security Audit — agent-trust-hub — refactor-backend-01-architecture