architecture-rules-generator

Pass

Audited by Gen Agent Trust Hub on Jul 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill workflow includes running npx @nextstage-brasil/harness sync to update harness adapters in the local environment (SKILL.md). This command executes a tool provided by the author to maintain synchronization between rules and the agent environment.
  • [EXTERNAL_DOWNLOADS]: The use of npx to run vendor-owned packages may involve downloading these tools from official package registries if they are not already installed locally.
  • [SAFE]: The skill processes local repository content (manifests, directory structures, and documentation) to derive architecture facts. This reconnaissance workflow is the primary function of the skill.
  • Ingestion points: Scans local manifest files (e.g., package.json, composer.json) and documentation (README.md, docs/) (references/reconnaissance-checklist.md).
  • Boundary markers: Output is formatted into specific tables and sections, but no explicit markers are used to separate untrusted repo content from agent instructions.
  • Capability inventory: File writing to the rules directory and execution of vendor-specific CLI tools (SKILL.md).
  • Sanitization: Data is summarized and condensed before being written to the output file (references/compression-guide.md).
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 8, 2026, 09:41 PM
Security Audit — agent-trust-hub — architecture-rules-generator