improve-codebase-architecture
Warn
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
git logto analyze codebase history and uses system-specific commands (open,xdg-open,start) to display the generated HTML report to the user.- [EXTERNAL_DOWNLOADS]: The generated architectural report fetches the Tailwind CSS library and the Mermaid diagramming library from well-known content delivery networks (tailwindcss.com and jsdelivr.net).- [DYNAMIC_EXECUTION]: The skill configures the Mermaid library withsecurityLevel: "loose"in the generated HTML report. This setting allows HTML tags to be rendered within diagrams, which presents a cross-site scripting (XSS) risk if untrusted data from the codebase is included in the visuals without proper sanitization.- [INDIRECT_PROMPT_INJECTION]:\n - Ingestion points: The skill reads source code files, commit history, and architectural documentation (
CONTEXT.md,ADRs).\n - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are provided when processing project files.\n
- Capability inventory: The skill can write files to the system temporary directory, spawn sub-agents, and execute shell commands to open the generated files.\n
- Sanitization: The instructions do not specify any escaping or sanitization of codebase content before it is written into the HTML report.
Audit Metadata