architecture-scalability-review
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill instructions include a mandatory gate (G7) to ensure that the final audit reports redact credentials and do not expose secrets discovered during the inspection of project files. This demonstrates a proactive security posture.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted project data (documentation, ADRs, source code). To mitigate risks of indirect injection, it implements a structured scoring system, adversarial validation (Scorecard Validation Gate), and explicit human-in-the-loop checkpoints for any recommendations involving new technologies or libraries.
- [COMMAND_EXECUTION]: The workflow utilizes standard development tools and custom project-specific commands (e.g.,
$project-init,graph trace,$why-review) for gathering evidence. These operations are scoped to the project environment and include instructions to ask the user if a tool cannot be run safely.
Audit Metadata