skf-refine-architecture

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses uv run to execute various helper scripts within its own ecosystem, such as skf-enumerate-stack-skills.py, skf-comention-pairs.py, and skf-check-preservation.py. These tools are part of the SKF (Skill Forge) framework developed by the author and are necessary for the skill's primary function of analyzing and merging architectural documents.
  • [DYNAMIC_EXECUTION]: The Python script scripts/skf-check-preservation.py dynamically loads the feasibility reader module using importlib.util.spec_from_file_location. This is used to read and validate [VS] (Verify Stack) report files, which is a core feature of the refinement workflow.
  • [EXTERNAL_DOWNLOADS]: The skill uses uv to manage dependencies and run scripts. While uv can fetch packages, the specific invocations are directed at local project scripts or known project infrastructure ({project-root}/_bmad/skf/). The skill also references well-known registries like NPM for framework installation in its help messages.
  • [PRIVILEGE_ESCALATION]: The skill performs directory creation (mkdir -p) and file writes, but these are scoped to the project's output and configuration folders (_bmad-output, _bmad/skf/config.yaml). There are no attempts to gain administrative or root privileges.
  • [SAFE]: All identified high-severity patterns (like subprocess calls and file manipulation) are well-justified by the skill's stated purpose of being a Ferris Architect refinement tool. The resource access patterns align with standard software development and documentation workflows.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 02:48 PM