improve-codebase-architecture
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill contains explicit defensive instructions to treat repository content as evidence to be evaluated rather than commands to be obeyed, effectively mitigating potential indirect prompt injection from codebase files.
- [COMMAND_EXECUTION]: The skill uses platform-specific commands (
open,xdg-open,start) to display the generated architecture report. This behavior is restricted to opening the locally generated file in the default browser/viewer. - [DATA_EXFILTRATION]: The skill is designed to operate offline. The generated HTML report is self-contained with inline CSS and SVG, and the Content Security Policy explicitly blocks external network requests (
default-src 'none'). - [DYNAMIC_EXECUTION]: While the skill generates an HTML document dynamically, it mandates escaping all external strings and prohibits the use of remote scripts or executable JavaScript within the report.
Audit Metadata