architecture-zoom
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, creating an attack surface for malicious instructions that could be embedded in source code or project documentation.
- Ingestion points: As described in the
SKILL.mdunder "Inputs to inspect" and the "Workflow" steps, the agent is instructed to read user requests, repository source code, local Architecture Decision Records (ADRs), and existing work items. - Boundary markers: The instructions do not define explicit delimiters or "ignore instructions" warnings to prevent the agent from following commands embedded within the code or files it is analyzing.
- Capability inventory: The skill maintains a strong security posture by explicitly disclaiming operational authority; it lacks the ability to execute shell commands, perform network operations, or write to the filesystem without host-level permission (stated in
SKILL.mdunder "Safety rules"). - Sanitization: There are no mentioned mechanisms for sanitizing or escaping the content of external files before they are processed by the agent.
Audit Metadata