vibe-to-arch
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized access attempts were detected within the skill instructions, scripts, or methodology.
- [PROMPT_INJECTION]: The skill instructions involve an indirect prompt injection surface because they require the agent to read and analyze user-provided code and documentation (Phase 1 code, LEARNINGS.md, and SPEC.md) in phase2-graduate.md and phase3-rebuild.md. However, the risk is minimal because this behavior is intrinsic to the skill's primary function of code analysis and refactoring, and the skill does not use high-risk capabilities like network access or shell execution.
- Ingestion points: User-provided project code and documentation files (
LEARNINGS.md,SPEC.md) are loaded into the agent context in phase2-graduate.md and phase3-rebuild.md. - Boundary markers: None. The instructions do not define specific delimiters or "ignore embedded instructions" warnings for the ingested data.
- Capability inventory: The skill performs file reading and structural analysis; no network tools, subprocesses, or arbitrary command execution patterns are present.
- Sanitization: None. The skill analyzes the files as-is without validation or filtering.
Audit Metadata