archlang-brief-to-plan
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of the
archlangCLI tool to perform operations such as compilation, linting, and rendering (e.g.,archlang compile,archlang lint,archlang preview). These commands are executed within the agent's shell environment to process generated files. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and interpret a "written brief" provided by a user to generate
.archsource code. This introduces a surface for indirect prompt injection where a malicious brief could attempt to influence the agent's logic or the generated code. - Ingestion points: User-supplied floor plan briefs (SKILL.md).
- Boundary markers: Absent. The skill does not provide specific delimiters or instructions for the agent to treat the brief as untrusted data.
- Capability inventory: Shell command execution via multiple
archlangsubcommands (SKILL.md). - Sanitization: Absent. The workflow relies on the
archlangcompiler and linter to validate the generated file, but does not explicitly sanitize the initial text brief. - [EXTERNAL_DOWNLOADS]: The skill requires the
@chanmeng666/archlangpackage, which is fetched from the NPM registry vianpxornpm install. This package is a resource associated with the skill's author.
Audit Metadata