improve-codebase-architecture
Warn
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
git log --onelineto analyze repository history and employs platform-specific commands such asxdg-open,open, andstartto launch the generated HTML report. - [DYNAMIC_EXECUTION]: The skill generates a self-contained HTML report containing JavaScript for visualization via Tailwind and Mermaid, writing it to the system's temporary directory for execution in a browser.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted codebase data and renders it into a visual report. The template uses Mermaid with
securityLevel: "loose", which allows HTML tags and click events, creating an XSS surface if malicious data is extracted from the codebase. * Ingestion points: Codebase files,CONTEXT.md, and git history. * Boundary markers: No delimiters or sanitization instructions are defined in the HTML template. * Capability inventory: File system write and shell command execution. * Sanitization: The template lacks explicit sanitization for codebase content rendered within the diagrams. - [EXTERNAL_DOWNLOADS]: The generated report fetches visualization resources from well-known services: Tailwind CSS via
cdn.tailwindcss.comand Mermaid viacdn.jsdelivr.net.
Audit Metadata