archlang-export

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses the archlang CLI tool which is downloaded from the author's official NPM package registry (@chanmeng666/archlang) via npx or npm install.
  • [COMMAND_EXECUTION]: The skill involves running shell commands using the archlang tool to compile, finish, and batch process architectural drawings.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided .arch floor plan files, creating a potential surface for indirect prompt injection if the input files contain malicious content.
  • Ingestion points: The skill reads and compiles .arch files provided by the user (SKILL.md).
  • Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the processed files.
  • Capability inventory: The skill uses shell commands such as archlang compile, archlang finish, and archlang batch (SKILL.md).
  • Sanitization: No specific sanitization or validation of the input file content is mentioned prior to execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 10:00 PM