improve-codebase-architecture
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted codebase data, including source code and git logs, to generate an architectural report. \n
- Ingestion points: Reads codebase files and git history in the explore phase (SKILL.md). \n
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified for the sub-agent exploration phase. \n
- Capability inventory: The skill executes git commands, writes to the temporary directory, and opens files via system commands. \n
- Sanitization: The HTML-REPORT.md template mandates HTML-escaping of all repository-sourced text and sets Mermaid's securityLevel to strict to prevent script injection. \n- [COMMAND_EXECUTION]: The skill uses local system commands to retrieve information and display results. \n
- Executes git log to identify codebase hot spots. \n
- Uses xdg-open (Linux), open (macOS), or start (Windows) to present the generated report to the user. \n- [EXTERNAL_DOWNLOADS]: The generated report references external assets from well-known content delivery networks. \n
- Loads Tailwind CSS from cdn.tailwindcss.com. \n
- Loads the Mermaid library from cdn.jsdelivr.net.
Audit Metadata