archify
Fail
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill is a 'catalog stub' that downloads its full implementation, including Node.js CLI tools, schemas, and renderers, from an external repository at
github.com/tt-a1i/archifyduring the installation process. - [REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute Node.js scripts (
bin/archify.mjsandscripts/check-update.mjs) that are sourced from the third-party external repository, posing a high risk of remote code execution if the source repository is compromised. - [COMMAND_EXECUTION]: The skill relies on system-level command execution via
nodefor its core operations, including diagnostic checks ('doctor' command) and the main diagram generation logic. - [DATA_EXFILTRATION]: The skill includes an 'Update awareness' step that makes outbound network calls to GitHub to fetch a release manifest, which could potentially be used for tracking or signaling.
Recommendations
- AI detected serious security threats
Audit Metadata