improve-codebase-architecture
Warn
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill generates an architectural review as an HTML file in the system's temporary directory and then uses platform-specific commands (
xdg-open,open, orstart) to automatically open the file for the user. This pattern executes a generated file within the user's local environment. - [EXTERNAL_DOWNLOADS]: The generated HTML reports are configured to fetch external dependencies at runtime from public content delivery networks (CDNs). It specifically references Tailwind CSS from
cdn.tailwindcss.comand the Mermaid diagramming library fromcdn.jsdelivr.net. - [DATA_EXFILTRATION]: The skill presents an indirect prompt injection surface by processing codebase content (such as comments or file names) and rendering it into the generated HTML report. The Mermaid diagramming library is explicitly initialized with
securityLevel: "loose", which enables higher interactivity and potentially allows the execution of scripts embedded within the processed data if that data is malicious. - [REMOTE_CODE_EXECUTION]: The combination of generating local HTML files, loading external scripts, and automatically executing the file creates a potential pathway for remote code execution if the external sources or the data processed from the codebase are compromised.
Audit Metadata