graphify-architecture-review
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) as it processes untrusted repository data to generate architecture insights. Malicious instructions embedded in the analyzed code could influence subagents or the final review conclusions.\n
- Ingestion points: Repository source files, documentation, and planning docs are read from the file system (SKILL.md, SOP.md).\n
- Boundary markers: Prompts for extraction agents use basic constraints (e.g., "Read only the listed files", "Output JSON only") but lack explicit delimiters or instructions to ignore embedded commands (SOP.md Section 2).\n
- Capability inventory: The skill employs Bash command execution, file writing, editing, and subagent dispatching (SKILL.md frontmatter).\n
- Sanitization: No evidence of sanitization or escaping of ingested codebase content before it is processed by the AI agents exists in the provided scripts or instructions.\n- [COMMAND_EXECUTION]: The skill executes the
graphifyCLI tool along with standard utilities such asjq,rg,test, andgit. These commands use arguments (like node names or file paths) that are derived from the codebase being analyzed, which could lead to command injection if the underlying tool does not properly handle malicious file names or class/method labels.
Audit Metadata