Skip to content
Report library
Purpose / Development

Improve Codebase Architecture Skill Security Audit

What the author says it does (original text)

Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.

Independent security check

Do not install or run it yet

Files checked
3
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
High risk

The automatically opened report executes unpinned third-party CDN scripts with Mermaid's loose security mode

Source references: 4
What we found

The template loads a floating script from cdn.tailwindcss.com and Mermaid from jsDelivr pinned only to major version 11; both execute when the report opens. Mermaid is configured with securityLevel: "loose". Repository content feeds the diagrams and report, but the instructions do not require escaping text inserted into HTML or Mermaid.

Why this matters

If CDN content is altered, its supply chain is compromised, or version behavior changes, third-party code could read the report DOM—including file names and architecture findings—and make network requests. Malicious repository text inserted without escaping could also produce active content or a deceptive report under loose mode.

The report must be opened automatically, at which point the browser executes code from two third-party CDNs. Tailwind is unversioned, Mermaid is pinned only to major version 11, and Mermaid uses a permissive security mode. If CDN content is replaced, or repository text enters HTML/Mermaid without escaping, code or crafted content could run with the report page's browser permissions. The source does not prove that repository text is actually left unescaped, so that part is conditional. Users can ask for fully pinned resources with integrity checks, local static assets, strict mode and explicit escaping, or restrict automatic opening/network access.

SKILL.md:39In the instructionsOpen original file
Write a self-contained HTML file to the OS temp directory so nothing lands in the repo. Resolve the temp dir from `$TMPDIR`, falling back to `/tmp` (or `%TEMP%` on Windows), and write to `<tmpdir>/architecture-review-<timestamp>.html` so each run gets a fresh file. Open it for the user (`xdg-open <path>` on Linux, `open <path>` on macOS, `start <path>` on Windows) and tell them the absolute path.The report uses **Tailwind via CDN** for layout and styling, and **Mermaid via CDN** for diagrams where a graph/flow/sequence reliably communicates the structure. Mix Mermaid with hand-crafted CSS/SVG visuals: use Mermaid when relationships are graph-shaped (call graphs, dependencies, sequences), and hand-built divs/SVG when you want something more editorial (mass diagrams, cross-sections, collapse animations). Each candidate gets a **before/after visualisation**. Be visual.
Show 3 other places
HTML-REPORT.md:12In the instructionsOpen original file
    <meta charset="utf-8" />    <title>Architecture review for {{repo name}}</title>    <script src="https://cdn.tailwindcss.com"></script>    <script type="module">      import mermaid from "https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs";      mermaid.initialize({ startOnLoad: true, theme: "neutral", securityLevel: "loose" });    </script>    <style>
HTML-REPORT.md:96In the instructionsOpen original file
- Lean editorial, not corporate-dashboard. Generous whitespace. Serif optional for headings (`font-serif` works well with stone/slate).- Colour sparingly: one accent (emerald or indigo) plus red for leakage and amber for warnings.- Keep diagrams ~320px tall so before/after sits comfortably side by side without scrolling.- Use `text-xs uppercase tracking-wider` for module labels inside diagrams, so they read as schematic, not as UI.- The only scripts are the Tailwind CDN and the Mermaid ESM import. The report is otherwise static: no app code, no interactivity beyond Mermaid's own rendering.
HTML-REPORT.md:100In the instructionsOpen original file
- Use `text-xs uppercase tracking-wider` for module labels inside diagrams, so they read as schematic, not as UI.- The only scripts are the Tailwind CDN and the Mermaid ESM import. The report is otherwise static: no app code, no interactivity beyond Mermaid's own rendering.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

Selecting a candidate can cause lasting domain-document changes without separate confirmation

Source references: 3
What we found

The Skill explicitly says side effects occur inline: new concepts are added to CONTEXT.md, the file is created if absent, and clarified terms are updated immediately. It does not require showing a diff or obtaining renewed consent before writing.

Why this matters

A user who only intended to explore an architecture option may receive unexpected workspace changes. They can dirty uncommitted work, alter how future agents interpret the project, or prematurely turn tentative terminology into project convention.

Choosing a candidate explicitly authorizes further discussion, but the Skill then says side effects occur inline and directs the agent to create or immediately update CONTEXT.md. Only the ADR branch expressly asks the user first. Consequently, a new name or clarified term arising during discussion could create or permanently modify project documentation without separate confirmation or a diff preview. Users can restrict the Skill to read-only operation or require every CONTEXT.md change to be shown as a diff and individually approved.

SKILL.md:64In the instructionsOpen original file
Once the user picks a candidate, call the Skill tool with "grilling" to walk the decision tree with them: constraints, dependencies, the shape of the deepened module, what sits behind the seam, what tests survive.Side effects happen inline as decisions crystallize; call the Skill tool with "domain-modeling" to keep the domain model current as you go:- **Naming a deepened module after a concept not in `CONTEXT.md`?** Add the term to `CONTEXT.md`. Create the file lazily if it doesn't exist.- **Sharpening a fuzzy term during the conversation?** Update `CONTEXT.md` right there.- **User rejects the candidate with a load-bearing reason?** Offer an ADR, framed as: _"Want me to record this as an ADR so future architecture reviews don't re-suggest it?"_ Only offer when the reason would actually be needed by a future explorer to avoid re-suggesting the same thing; skip ephemeral reasons ("not worth it right now") and self-evident ones.- **Want to explore alternative interfaces for the deepened module?** Call the Skill tool with "codebase-design" and use its design-it-twice parallel sub-agent pattern.
Show 2 other places
SKILL.md:60In the instructionsOpen original file
Do NOT propose interfaces yet. After the file is written, ask the user: "Which of these would you like to explore?"### 3. Grilling loopOnce the user picks a candidate, call the Skill tool with "grilling" to walk the decision tree with them: constraints, dependencies, the shape of the deepened module, what sits behind the seam, what tests survive.
SKILL.md:66In the instructionsOpen original file
Side effects happen inline as decisions crystallize; call the Skill tool with "domain-modeling" to keep the domain model current as you go:- **Naming a deepened module after a concept not in `CONTEXT.md`?** Add the term to `CONTEXT.md`. Create the file lazily if it doesn't exist.- **Sharpening a fuzzy term during the conversation?** Update `CONTEXT.md` right there.- **User rejects the candidate with a load-bearing reason?** Offer an ADR, framed as: _"Want me to record this as an ADR so future architecture reviews don't re-suggest it?"_ Only offer when the reason would actually be needed by a future explorer to avoid re-suggesting the same thing; skip ephemeral reasons ("not worth it right now") and self-evident ones.- **Want to explore alternative interfaces for the deepened module?** Call the Skill tool with "codebase-design" and use its design-it-twice parallel sub-agent pattern.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

Untrusted repository text may steer the agent's conclusions and later actions

Source references: 3
What we found

The Skill directs the agent to read CONTEXT.md, ADRs, commit history, and broadly explore code, without instructing it to treat command-like text there only as data. The agent then uses those materials to select recommendations and enters a workflow capable of changing project documentation.

Why this matters

A malicious or contaminated repository could place prompt-injection text in documentation, history, or source text to distort findings, broaden inspection, or induce later documentation changes that do not match the user's intent.

What this evidence establishes

The Skill does require reading commit history, CONTEXT.md, ADRs and code, and lets those materials shape scan scope, recommendations and later discussion. However, the visible source never instructs the agent to obey commands found in those files, and no malicious repository text is shown. The claim that repository text will hijack the agent therefore lacks direct evidence; at most, the Skill omits an explicit untrusted-content rule. Users can ask the author to treat repository text only as data, ignore agent-directed instructions within it, and disclose sources and proposed changes before any write.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:22In the instructionsOpen original file
- If the user named a direction (a module, a subsystem, a pain point), take it, and skip the inference below.- Otherwise, walk back a good stretch of the commit history (`git log --oneline`) to find the codebase's hot spots, the files and areas that keep coming up, and let those paths pull your attention first. If the changes are scattered with no clear hot spot, widen the net.Read the project's domain glossary (`CONTEXT.md`) and any ADRs in the area you're touching first.Then spawn a sub-agent to walk the codebase. Don't follow rigid heuristics; explore organically and note where you experience friction:
Show 2 other places
SKILL.md:64In the instructionsOpen original file
Once the user picks a candidate, call the Skill tool with "grilling" to walk the decision tree with them: constraints, dependencies, the shape of the deepened module, what sits behind the seam, what tests survive.Side effects happen inline as decisions crystallize; call the Skill tool with "domain-modeling" to keep the domain model current as you go:- **Naming a deepened module after a concept not in `CONTEXT.md`?** Add the term to `CONTEXT.md`. Create the file lazily if it doesn't exist.- **Sharpening a fuzzy term during the conversation?** Update `CONTEXT.md` right there.- **User rejects the candidate with a load-bearing reason?** Offer an ADR, framed as: _"Want me to record this as an ADR so future architecture reviews don't re-suggest it?"_ Only offer when the reason would actually be needed by a future explorer to avoid re-suggesting the same thing; skip ephemeral reasons ("not worth it right now") and self-evident ones.- **Want to explore alternative interfaces for the deepened module?** Call the Skill tool with "codebase-design" and use its design-it-twice parallel sub-agent pattern.
SKILL.md:54In the instructionsOpen original file
**Use CONTEXT.md vocabulary for the domain, and the `/codebase-design` vocabulary for the architecture.** If `CONTEXT.md` defines "Order," talk about "the Order intake module," not "the FooBarHandler," and not "the Order service."**ADR conflicts**: if a candidate contradicts an existing ADR, only surface it when the friction is real enough to warrant revisiting the ADR. Mark it clearly in the card (e.g. a warning callout: _"contradicts ADR-0007, but worth reopening because…"_). Don't list every theoretical refactor an ADR forbids.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

The Skill scopes its scan using either the user's chosen direction or Git history, then reads CONTEXT.md and relevant ADRs and has a sub-agent inspect the codebase for architectural friction.

View source
SKILL.md:20In the instructionsOpen original file
**Scope before you scan: YAGNI.** Deepening a module pays off by making future changes to it easier, so put extra weight on the parts of the codebase that have recently changed. Decide *where* to look before you look:- If the user named a direction (a module, a subsystem, a pain point), take it, and skip the inference below.- Otherwise, walk back a good stretch of the commit history (`git log --oneline`) to find the codebase's hot spots, the files and areas that keep coming up, and let those paths pull your attention first. If the changes are scattered with no clear hot spot, widen the net.Read the project's domain glossary (`CONTEXT.md`) and any ADRs in the area you're touching first.Then spawn a sub-agent to walk the codebase. Don't follow rigid heuristics; explore organically and note where you experience friction:

Scan results are written to a fresh HTML file in the operating-system temporary directory and automatically opened with the default application; the report is not placed in the repository.

View source
SKILL.md:37In the instructionsOpen original file
### 2. Present candidates as an HTML reportWrite a self-contained HTML file to the OS temp directory so nothing lands in the repo. Resolve the temp dir from `$TMPDIR`, falling back to `/tmp` (or `%TEMP%` on Windows), and write to `<tmpdir>/architecture-review-<timestamp>.html` so each run gets a fresh file. Open it for the user (`xdg-open <path>` on Linux, `open <path>` on macOS, `start <path>` on Windows) and tell them the absolute path.The report uses **Tailwind via CDN** for layout and styling, and **Mermaid via CDN** for diagrams where a graph/flow/sequence reliably communicates the structure. Mix Mermaid with hand-crafted CSS/SVG visuals: use Mermaid when relationships are graph-shaped (call graphs, dependencies, sequences), and hand-built divs/SVG when you want something more editorial (mass diagrams, cross-sections, collapse animations). Each candidate gets a **before/after visualisation**. Be visual.

After the user selects a candidate, the Skill enters a questioning workflow and may create or update CONTEXT.md directly during the discussion.

View source
SKILL.md:62In the instructionsOpen original file
### 3. Grilling loopOnce the user picks a candidate, call the Skill tool with "grilling" to walk the decision tree with them: constraints, dependencies, the shape of the deepened module, what sits behind the seam, what tests survive.Side effects happen inline as decisions crystallize; call the Skill tool with "domain-modeling" to keep the domain model current as you go:- **Naming a deepened module after a concept not in `CONTEXT.md`?** Add the term to `CONTEXT.md`. Create the file lazily if it doesn't exist.- **Sharpening a fuzzy term during the conversation?** Update `CONTEXT.md` right there.- **User rejects the candidate with a load-bearing reason?** Offer an ADR, framed as: _"Want me to record this as an ADR so future architecture reviews don't re-suggest it?"_ Only offer when the reason would actually be needed by a future explorer to avoid re-suggesting the same thing; skip ephemeral reasons ("not worth it right now") and self-evident ones.- **Want to explore alternative interfaces for the deepened module?** Call the Skill tool with "codebase-design" and use its design-it-twice parallel sub-agent pattern.
Start here · InstructionsSKILL.md
improve-codebase-architecture
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 1
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records3 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • HTML-REPORT.mdFull text included
  • agents/openai.yamlFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • HTML-REPORT.mdSupporting file
  • SKILL.mdInstructions
  • agents/openai.yamlSupporting file

Operations mentioned in code and instructions

Connect to websites
HTML-REPORT.md:13In the instructionsOpen original file
    <title>Architecture review for {{repo name}}</title>    <script src="https://cdn.tailwindcss.com"></script>    <script type="module">
HTML-REPORT.md:15In the instructionsOpen original file
    <script type="module">      import mermaid from "https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs";      mermaid.initialize({ startOnLoad: true, theme: "neutral", securityLevel: "loose" });
Lines read
202
File checksum (to compare versions)
9e69d6e1cd38b607f78afa616a1512440168e1b28e9ed0ad05050d057f98e5f9