c4-architecture-c4-architecture
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection. It systematically reads all subdirectories and files within a repository and provides the raw content to a general-purpose subagent. There are no explicit instructions or delimiters used to prevent the subagent from following malicious instructions that might be embedded in the code being analyzed (e.g., in comments, string literals, or documentation blocks).
- Ingestion points: The skill reads every subdirectory and file in the target repository to generate code-level documentation (Phase 1.1, 1.2).
- Boundary markers: Absent. No delimiters or 'ignore embedded instructions' warnings are provided to the subagents analyzing the code.
- Capability inventory: The workflow leverages a
Tasktool with ageneral-purposesubagent, which may have the capability to execute commands or access the filesystem depending on the agent's configuration. - Sanitization: There is no evidence of sanitization, escaping, or validation of the codebase content before it is processed by the subagent.
- [COMMAND_EXECUTION]: By employing a general-purpose subagent to analyze raw code files, the skill creates an environment where malicious content in the repository could potentially trick the agent into executing unauthorized operations or accessing sensitive data outside the intended scope of documentation generation.
Audit Metadata