improve-codebase-architecture
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
git logto identify active code areas and invokes system-level commands likeopen,xdg-open, orstartto display the generated HTML report. - [EXTERNAL_DOWNLOADS]: The HTML report template fetches Tailwind CSS and Mermaid.js from official CDNs (
cdn.tailwindcss.comandcdn.jsdelivr.net), which are recognized well-known services. - [PROMPT_INJECTION]: The skill ingests untrusted codebase content and commit history. While it uses architectural vocabulary as boundary markers, the resulting HTML report lacks explicit sanitization for codebase strings, creating a potential surface for indirect injection or XSS when the user opens the generated file. Capability inventory includes temporary file writing and shell execution.
Audit Metadata