improve-codebase-architecture
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from the local codebase and git history, which is then rendered into an HTML report.
- Ingestion points: Reads repository source files, git log history, and Architecture Decision Records (ADRs) to inform its analysis.
- Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from following instructions embedded within the codebase being scanned.
- Capability inventory: The skill can write files to the system's temporary directory and execute shell commands to open them.
- Sanitization: The instructions for generating the HTML report in HTML-REPORT.md suggest initializing Mermaid.js with loose security, which could facilitate the execution of scripts if codebase content is not properly sanitized before inclusion.
- [EXTERNAL_DOWNLOADS]: The architectural reports generated by the skill reference scripts and styles from well-known content delivery networks.
- Loads the Tailwind CSS framework from cdn.tailwindcss.com for report styling.
- Fetches the Mermaid.js library from cdn.jsdelivr.net to render architectural diagrams.
- [COMMAND_EXECUTION]: The skill utilizes platform-specific commands to display the generated HTML report to the user and dynamically generates content.
- Uses xdg-open (Linux), open (macOS), or start (Windows) to launch the default browser and view the temporary report file.
- Dynamically assembles an HTML file in the OS temporary directory populated with findings from the codebase analysis.
Audit Metadata