archify
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing local Node.js scripts (
bin/archify.mjsandscripts/check-update.mjs) to perform core functions including diagram validation, artifact delivery, and screenshot generation using thevisual-checkcommand.- [EXTERNAL_DOWNLOADS]: The skill features abrands capturecommand that allows the agent to fetch external assets from user-provided URLs. Additionally, thecheck-update.mjsscript performs network operations to verify the status of remote manifests for software updates.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data in the form of plain-language requirements and Mermaid diagram syntax (flowcharts, sequence diagrams, and state diagrams). - Ingestion points: User-provided text requirements and Mermaid diagram code processed in the 'Fast authoring path'.
- Boundary markers: The instructions mandate a manual parsing step where the agent transforms user input into a specific JSON schema, which acts as a logical filter between input and execution.
- Capability inventory: The skill possesses the ability to write files (HTML/JSON), execute subprocesses via Node.js, and perform network requests for brand captures and update checks.
- Sanitization: The workflow includes a mandatory validation step (
node bin/archify.mjs validate) to ensure that the generated specifications conform to strict schemas before they are delivered.
Audit Metadata