arch-check

Pass

Audited by Gen Agent Trust Hub on Jul 24, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill performs localized software analysis using provided tools and does not exhibit any patterns of data exfiltration, obfuscation, or unauthorized command execution.\n- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it derives its analysis rules from local files like CLAUDE.md or ADRs which are user-controllable. This surface is necessary for its primary functionality of validating code against project-specific architecture.\n
  • Ingestion points: Architecture definitions are read from CLAUDE.md, documentation in docs/decisions/, or codebase source files.\n
  • Boundary markers: No explicit markers are used to isolate instructions from architectural metadata.\n
  • Capability inventory: The skill uses read-only analysis tools (get_project_graph, find_references, etc.) for auditing structure.\n
  • Sanitization: No content validation is performed on ingested architectural definitions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 24, 2026, 02:25 AM
Security Audit — agent-trust-hub — arch-check