c4-architecture
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTION
Full Analysis
- [NO_CODE]: The skill does not include any scripts or executable files. It is composed of Markdown files providing instructions, examples, and reference material for the AI agent to follow when generating documentation.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local codebase files to identify architectural components, which creates a standard vulnerability surface for indirect prompt injection.
- Ingestion points: The agent is instructed to "Analyze codebase" and "Explore the system" to identify relationships (referenced in
SKILL.mdandREADME.md). - Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings for the agent when reading source code comments or documentation.
- Capability inventory: The skill allows the agent to read project files and write resulting diagrams to the
docs/architecture/directory. - Sanitization: There are no explicit instructions to sanitize or validate the content retrieved from the codebase before it is used to generate the Mermaid diagrams.
Audit Metadata