improve-codebase-architecture
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's operations are limited to scanning codebases for architectural patterns and generating local reports. It includes explicit instructions to avoid writing to global system directories, adhering to the principle of least privilege.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an inherent attack surface as it processes external codebase files which could contain malicious instructions designed to influence the agent's analysis.
- Ingestion points: Scans source code files,
.agents/projects/<project>/CONTEXT.md, and project Architectural Decision Records (ADRs). - Boundary markers: The instructions do not define specific delimiters for separating codebase content from the agent's instructions during the analysis phase.
- Capability inventory: The skill has capabilities to read local project files and write markdown and HTML reports to the project's directory.
- Sanitization: There are no explicit sanitization steps for the ingested code content before it is interpolated into the report generation logic.
- [EXTERNAL_DOWNLOADS]: The skill generates HTML reports that reference well-known and trusted Content Delivery Networks (CDNs) for Tailwind CSS and Mermaid.js. This is standard functionality for producing visual reports and does not constitute a security risk.
Audit Metadata