improve-codebase-architecture
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches Tailwind CSS and Mermaid.js from official CDNs to style and render the architecture report. These are well-known and established services used for legitimate visualization purposes.- [DYNAMIC_EXECUTION]: The report template in HTML-REPORT.md configures Mermaid with
securityLevel: "loose". This setting enables functionality such as click events and script execution within rendered diagrams, which presents a security risk if the diagram source (derived from the codebase) is maliciously crafted.- [INDIRECT_PROMPT_INJECTION]: The skill reviews codebase architecture by ingesting source code files and their dependencies to generate visual reports, which exposes the agent to instructions embedded in untrusted data. - Ingestion points: The skill reads local codebase files, module interfaces, and dependency definitions to identify candidates for deepening.
- Boundary markers: No explicit delimiters or boundary markers are used to separate the analyzed codebase content from the reporting logic.
- Capability inventory: The skill has the capability to write to the local file system (saving the HTML report to the OS temp directory) and can trigger network requests via the report's CDN references.
- Sanitization: The skill does not define specific sanitization or filtering logic for codebase content before it is incorporated into the generated HTML report or Mermaid diagram definitions.
Audit Metadata