data-architecture
Pass
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: SAFE
Full Analysis
- Configuration and Credential Discovery: The skill scans project files to extract database connection strings and JDBC URLs for documentation purposes. While this is a core feature for modernization assessments, users should be aware that any plain-text credentials found in the source or configuration files will be included in the resulting report.
- Sensitive Data Classification: A significant capability of this skill is the identification of sensitive data types like PII, PHI, and PCI within the application's entities. The generated
data-architecture.mdfile will list these fields and current security controls, providing a high-value summary of the project's data sensitivity landscape. - Indirect Prompt Injection Surface: Because this skill ingests and interprets arbitrary project source code (Java, .NET, JS/TS), it possesses an attack surface for indirect prompt injection. Maliciously crafted content within the analyzed files (such as comments or strings) could theoretically attempt to influence the agent's behavior during the analysis phase.
- Ingestion points: Project source code and configuration files read during Steps 1-6.
- Boundary markers: None explicitly defined in the prompt for separating code analysis from instruction processing.
- Capability inventory: File system read access for analysis and file system write access to save the assessment to
.github/modernize/assessment/engines/facts/data-architecture.md. - Sanitization: The skill uses highly structured output formats (Mermaid diagrams and specific Markdown tables), which naturally limits the impact of potential injection by constraining the output format.
Audit Metadata