skf-refine-architecture
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
uv runto execute various helper scripts within its own ecosystem, such asskf-enumerate-stack-skills.py,skf-comention-pairs.py, andskf-check-preservation.py. These tools are part of the SKF (Skill Forge) framework developed by the author and are necessary for the skill's primary function of analyzing and merging architectural documents. - [DYNAMIC_EXECUTION]: The Python script
scripts/skf-check-preservation.pydynamically loads the feasibility reader module usingimportlib.util.spec_from_file_location. This is used to read and validate [VS] (Verify Stack) report files, which is a core feature of the refinement workflow. - [EXTERNAL_DOWNLOADS]: The skill uses
uvto manage dependencies and run scripts. Whileuvcan fetch packages, the specific invocations are directed at local project scripts or known project infrastructure ({project-root}/_bmad/skf/). The skill also references well-known registries like NPM for framework installation in its help messages. - [PRIVILEGE_ESCALATION]: The skill performs directory creation (
mkdir -p) and file writes, but these are scoped to the project's output and configuration folders (_bmad-output,_bmad/skf/config.yaml). There are no attempts to gain administrative or root privileges. - [SAFE]: All identified high-severity patterns (like subprocess calls and file manipulation) are well-justified by the skill's stated purpose of being a Ferris Architect refinement tool. The resource access patterns align with standard software development and documentation workflows.
Audit Metadata