skills/andreibesleaga/gabbe/arch-debt/Gen Agent Trust Hub

arch-debt

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Executes standard architectural analysis tools via shell commands to process project files and generate reports. Evidence includes the use of madge, dependency-cruiser, deptrac, phpstan, phpmetrics, import-linter, and pydeps across JavaScript, PHP, and Python environments.\n- [EXTERNAL_DOWNLOADS]: Fetches and executes developer tools from the official npm registry using npx. This includes packages such as madge and dependency-cruiser which are used for dependency graph visualization and rule enforcement.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local source code (e.g., in src/ or app/ directories) to generate architectural reports.\n
  • Ingestion points: Reads project source code from the local file system during analysis steps.\n
  • Boundary markers: The skill does not define specific delimiters for separating analyzed code from instructions, but requires human approval for major architectural changes.\n
  • Capability inventory: Executes shell commands for analysis and writes summary reports and tasks to project/TASKS.md.\n
  • Sanitization: Analyzed content is not explicitly sanitized before being incorporated into generated reports.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 02:44 PM