skills/anbeime/skill/archify/Gen Agent Trust Hub

archify

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on executing local Node.js scripts (bin/archify.mjs and scripts/check-update.mjs) to perform core functions including diagram validation, artifact delivery, and screenshot generation using the visual-check command.- [EXTERNAL_DOWNLOADS]: The skill features a brands capture command that allows the agent to fetch external assets from user-provided URLs. Additionally, the check-update.mjs script performs network operations to verify the status of remote manifests for software updates.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data in the form of plain-language requirements and Mermaid diagram syntax (flowcharts, sequence diagrams, and state diagrams).
  • Ingestion points: User-provided text requirements and Mermaid diagram code processed in the 'Fast authoring path'.
  • Boundary markers: The instructions mandate a manual parsing step where the agent transforms user input into a specific JSON schema, which acts as a logical filter between input and execution.
  • Capability inventory: The skill possesses the ability to write files (HTML/JSON), execute subprocesses via Node.js, and perform network requests for brand captures and update checks.
  • Sanitization: The workflow includes a mandatory validation step (node bin/archify.mjs validate) to ensure that the generated specifications conform to strict schemas before they are delivered.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 12:35 PM