c4-architecture
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface
- Ingestion points: The skill workflow includes an "Analyze codebase" step in both README.md and SKILL.md, which requires the agent to ingest and process contents from the user's project files.
- Boundary markers: The instructions lack specific boundary markers or requirements to ignore potentially malicious instructions embedded in comments or strings within the codebase being analyzed.
- Capability inventory: The skill possesses the capability to read all files in the repository and write documentation files into the
docs/architecture/directory. - Sanitization: There are no instructions provided for sanitizing or validating the content read from the codebase before it is used to generate diagrams or documentation.
- [NO_CODE]: The skill consists exclusively of Markdown files containing instructions and reference syntax. It does not include any scripts (e.g., Python, JavaScript), binaries, or automation configuration files.
Audit Metadata