improve-codebase-architecture
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes system-level commands to open the generated architectural report for the user. It utilizes
xdg-openon Linux,openon macOS, andstarton Windows to launch the user's default web browser targeting a temporary file path. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it ingests untrusted data from the codebase being analyzed, including source files and Architecture Decision Records (ADRs). However, it mitigates this by instructing the agent to treat repository content as untrusted and to escape all repository names, paths, and excerpts before inserting them into the HTML report. Additionally, it configures the Mermaid diagramming tool with a strict security level to prevent script execution within diagrams.
- [EXTERNAL_DOWNLOADS]: The generated HTML reports fetch resources from well-known and established service providers. Specifically, it downloads the Tailwind CSS framework from
tailwindcss.comand the Mermaid diagramming library from thejsdelivr.netCDN.
Audit Metadata