arch-debt
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes standard architectural analysis tools via shell commands to process project files and generate reports. Evidence includes the use of
madge,dependency-cruiser,deptrac,phpstan,phpmetrics,import-linter, andpydepsacross JavaScript, PHP, and Python environments.\n- [EXTERNAL_DOWNLOADS]: Fetches and executes developer tools from the official npm registry usingnpx. This includes packages such asmadgeanddependency-cruiserwhich are used for dependency graph visualization and rule enforcement.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local source code (e.g., insrc/orapp/directories) to generate architectural reports.\n - Ingestion points: Reads project source code from the local file system during analysis steps.\n
- Boundary markers: The skill does not define specific delimiters for separating analyzed code from instructions, but requires human approval for major architectural changes.\n
- Capability inventory: Executes shell commands for analysis and writes summary reports and tasks to
project/TASKS.md.\n - Sanitization: Analyzed content is not explicitly sanitized before being incorporated into generated reports.
Audit Metadata