improve-codebase-architecture
Warn
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill automatically executes system-level commands (
xdg-open,open, orstart) to open the generated HTML report in the user's default browser or application immediately after file creation. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local codebase, including file paths, commit history via
git log, and domain glossary content fromCONTEXT.md. This data is interpolated into the final HTML report without explicit instructions for sanitization or escaping, creating a surface for injection attacks if the codebase contains malicious content. - [DYNAMIC_EXECUTION]: The HTML report scaffold in
HTML-REPORT.mdinitializes the Mermaid.js library withsecurityLevel: "loose". This configuration allows for higher functionality in diagrams but also permits the execution of scripts within diagram definitions, which is risky when the definitions are generated from unvalidated codebase content. - [EXTERNAL_DOWNLOADS]: The generated reports are configured to fetch resources from external Content Delivery Networks (CDNs), specifically loading the Tailwind CSS framework from
cdn.tailwindcss.comand the Mermaid.js library fromcdn.jsdelivr.net. These are well-known services used to provide the report's visual styling and diagramming capabilities.
Audit Metadata