improve-codebase-architecture
Warn
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: MEDIUMINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the codebase, including ADRs, source code, and domain glossaries. This data is incorporated into an HTML report, providing a vector for embedded malicious payloads.
- [DYNAMIC_EXECUTION]: The HTML-REPORT.md file defines a scaffold that initializes Mermaid.js with securityLevel: "loose". This setting allows the execution of JavaScript within diagrams. A payload present in the codebase and subsequently rendered in a report diagram could facilitate cross-site scripting (XSS).
- [COMMAND_EXECUTION]: The skill automatically opens the generated HTML report using system commands such as xdg-open, open, or start, which triggers the loading of the file and its contained scripts in the browser.
- [EXTERNAL_DOWNLOADS]: The skill fetches Tailwind CSS and Mermaid.js from established content delivery networks to provide layout and diagramming capabilities for the generated report.
Audit Metadata