architect-review
Pass
Audited by Gen Agent Trust Hub on May 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous shell commands for auditing dependencies (
npm audit), installing packages (npm install), and running code analysis tools (npx madge,npm ls). - [EXTERNAL_DOWNLOADS]: Fetches documentation and code transformation scripts from external repositories, specifically from the official Facebook/Meta and ReactJS organizations on GitHub (e.g.,
raw.githubusercontent.com/facebook/react/...). - [REMOTE_CODE_EXECUTION]: Documentation describes running
jscodeshiftwith remote transformation URLs. This allows the execution of JavaScript code fetched from the network onto local source files. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it is designed to review and process user-provided code changes and architectural designs.
- Ingestion points: Analyzes software designs and code changes for review (SKILL.md).
- Boundary markers: No explicit instructions to ignore embedded commands in the data being reviewed.
- Capability inventory: Includes capabilities for package installation, file system analysis, and remote script execution through provided guides.
- Sanitization: No validation or sanitization of external content is specified before processing.
Audit Metadata