c4-architecture
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [NO_CODE]: The skill consists solely of markdown instructions and reference files. It does not contain any executable scripts (Python, Node.js, Shell, etc.), binary files, or external package dependencies.
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to analyze the local codebase to generate documentation. This pattern creates a surface for indirect prompt injection if the codebase contains malicious instructions intended to manipulate the documentation output. However, the skill's capabilities are limited to reading local files and writing documentation to a specific subdirectory, which is the intended functional purpose of the tool.
- Ingestion points: Project codebase files analyzed during the 'Analyze codebase' workflow step.
- Boundary markers: None defined.
- Capability inventory: Local file system read/write (specifically to the 'docs/architecture/' directory).
- Sanitization: None specified in the instructions; output is constrained by Mermaid syntax requirements.
- [SAFE]: No malicious patterns such as prompt injection, data exfiltration, obfuscation, or unauthorized command execution were detected. All external service references in the examples (e.g., AWS, Stripe, Kafka) are used for illustrative documentation purposes only and do not involve actual network connections or credential usage.
Audit Metadata