agent-ready
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a series of standard shell commands including 'find', 'ls', 'cat', 'grep', 'wc', and 'mkdir' across its various modes ('scaffold', 'architecture', 'claude-md', 'audit'). These commands are used for project discovery, analyzing documentation health, and identifying architectural patterns within the local repository.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by ingesting and analyzing content from existing project files such as 'CLAUDE.md', 'ARCHITECTURE.md', and source code to generate reports and suggest documentation refactors.
- Ingestion points: Content from 'CLAUDE.md', 'ARCHITECTURE.md', 'README.md', and various project source files is read and analyzed during the 'architecture', 'claude-md', and 'audit' workflows defined in 'SKILL.md'.
- Boundary markers: Absent. The instructions do not define specific delimiters or security warnings to prevent the agent from being influenced by instructions embedded within the codebase artifacts being analyzed.
- Capability inventory: The skill is capable of modifying and creating files within the repository structure, including directory creation and generating markdown documentation. It does not perform network operations or execute arbitrary scripts found in the processed data.
- Sanitization: Absent. The analysis logic performs metric calculation (line counts, directive density) and pattern matching on the raw text content of ingested files without sanitization or validation.
Audit Metadata