architecture-compass

Pass

Audited by Gen Agent Trust Hub on Jul 13, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute standard development commands for validation and linting, including pnpm, oxlint, oxfmt, and tsgo. These are used within the context of architectural enforcement and repository maintenance.
  • [EXTERNAL_DOWNLOADS]: The skill references a 'Preferred Stack Profile' that recommends the use of standard industry packages (e.g., Next.js, TanStack Query, Zod, Luxon) and provides guidance on supply-chain hardening via pnpm-workspace.yaml (e.g., strictDepBuilds, blockExoticSubdeps). These references are educational and intended for the target repository's configuration.
  • [DATA_EXFILTRATION]: While the skill instructions involve reading repository configuration files like .env or STACK_RULES.md, this is performed locally to extract architectural rules. The skill explicitly contains safety rules that forbid the inclusion of secrets, credentials, or private data in any output.
  • [PROMPT_INJECTION]: The skill includes instructions to ignore the bundled guardrails only if the user provides an explicit rejection rationale, and it provides a 'Decision precedence' list that prioritizes explicit user instructions while requiring agents to report conflicts with existing ADRs rather than bypassing them silently.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 13, 2026, 03:06 PM
Security Audit — agent-trust-hub — architecture-compass