Skip to content
skillsafebeta
← Report library
Purpose / Development

Architecture Patterns Skill Security Audit

What the author says it does (original text)

Implement proven backend architecture patterns including Clean Architecture, Hexagonal Architecture, and Domain-Driven Design. Use this skill when designing clean architecture for a new microservice, when refactoring a monolith to use bounded contexts, when implementing hexagonal or onion architecture patterns, or when debugging dependency cycles between application layers.

Independent security check

Security risks found

Files checked
3
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Low risk

The dependency-check step installs an unpinned third-party Python package

Source references: 1
What we found

The reference explicitly tells the user to run pip install pydeps without a pinned version, hashes, or an isolated environment. Installation retrieves packages from the configured index and runs their installation process.

Why this matters

A compromised or unexpectedly changed package or dependency could alter the active Python environment or execute unintended third-party installation code.

This appears in a fenced Bash reference as a manual diagnostic step; the Skill does not automatically run it. It explicitly recommends `pip install pydeps` without a pinned version or hash. If followed, pip obtains and installs whatever release the configured package source resolves, so exposure depends on that source and whether the environment is isolated. Users can ask for a pinned, verified version, or restrict installation to a disposable virtual environment/container after checking the package source.

references/advanced-patterns.md:385In the instructionsOpen original file
Visual dependency check — run this and look for any arrow pointing outward:```bash# Install: pip install pydepspydeps app --max-bacon=4 --cluster --rankdir=BT# Expected: domain has no outgoing edges to adapters or infrastructure```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

The payment example can charge before saving the order, and retries may charge again

Source references: 2
What we found

The order flow calls the payment gateway before marking and saving the order. The Stripe adapter directly invokes Charge.create, with no idempotency key or failure-compensation flow shown.

Why this matters

If order persistence or notification fails after the charge, a customer may be charged without a complete recorded order. Retrying the same request may create another charge.

This is example code under “worked examples,” so installing the Skill alone does not execute it. If adopted in production, however, `place_order` charges through the payment port before marking and saving the order, while the production adapter calls Stripe's `Charge.create`. The shown code has no idempotency key, persistence handling for a completed charge, or refund compensation if saving fails, creating a plausible charge-without-order or duplicate-charge risk on failure/retry. Users can ask for idempotent payments, explicit transaction boundaries, and compensation, and keep real payment credentials unavailable until those safeguards exist.

references/details.md:207In the instructionsOpen original file
    async def place_order(self, order: Order) -> OrderResult:        if not order.is_valid():            return OrderResult(success=False, error="Invalid order")        payment = await self.payments.charge(amount=order.total, customer=order.customer_id)        if not payment.success:            return OrderResult(success=False, error="Payment failed")        order.mark_as_paid()        saved_order = await self.orders.save(order)        await self.notifications.send(            to=order.customer_email,            subject="Order confirmed",            body=f"Order {order.id} confirmed",        )        return OrderResult(success=True, order=saved_order)
Show 1 other places
references/details.md:239In the instructionsOpen original file
# Production adapter: Stripeclass StripePaymentAdapter(PaymentGatewayPort):    def __init__(self, api_key: str):        import stripe        stripe.api_key = api_key        self._stripe = stripe    async def charge(self, amount: Money, customer: str) -> PaymentResult:        try:            charge = self._stripe.Charge.create(                amount=amount.cents, currency=amount.currency, customer=customer            )            return PaymentResult(success=True, transaction_id=charge.id)

Inside this skill

7 instruction sections

This Skill is architecture guidance intended to produce layered backend structures, dependency rules, interfaces, and test boundaries; the main file also directs the agent to two reference files for further detail.

View source
SKILL.md:10In the instructionsOpen original file
**Given:** a service boundary or module to architect.**Produces:** layered structure with clear dependency rules, interface definitions, and test boundaries.
SKILL.md:70In the instructionsOpen original file
## Detailed patterns and worked examplesDetailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient.
SKILL.md:153In the instructionsOpen original file
## Advanced PatternsFor detailed DDD bounded context mapping, full multi-service project trees, Anti-Corruption Layer implementations, and Onion Architecture comparisons, see:- [`references/advanced-patterns.md`](references/advanced-patterns.md)

Most content consists of guidance and example code; the testing section explicitly uses an in-memory repository to avoid a real database, Docker, and network access.

View source
SKILL.md:74In the instructionsOpen original file
## Testing — In-Memory AdaptersThe hallmark of correctly applied Clean Architecture is that every use case can be exercised in a plain unit test with no real database, no Docker, and no network:
SKILL.md:105In the instructionsOpen original file
async def test_create_user_succeeds():    repo = InMemoryUserRepository()    use_case = CreateUserUseCase(user_repository=repo)    response = await use_case.execute(CreateUserRequest(email="alice@example.com", name="Alice"))

The references also contain production-style examples that connect to external systems, including HTTP requests to a configurable URL, PostgreSQL pool creation, and Stripe charges; the snippets do not run automatically by themselves.

View source
references/advanced-patterns.md:166In the instructionsOpen original file
    def __init__(self, base_url: str, http_client: httpx.AsyncClient):        self._base_url = base_url        self._http = http_client    async def get_product_snapshot(self, sku: str) -> ProductSnapshot:        response = await self._http.get(f"{self._base_url}/products/{sku}")        response.raise_for_status()        data = response.json()
references/advanced-patterns.md:244In the instructionsOpen original file
@lru_cachedef get_settings() -> Settings:    return Settings()async def get_db_pool() -> asyncpg.Pool:    settings = get_settings()    return await asyncpg.create_pool(settings.database_url)
references/details.md:239In the instructionsOpen original file
# Production adapter: Stripeclass StripePaymentAdapter(PaymentGatewayPort):    def __init__(self, api_key: str):        import stripe        stripe.api_key = api_key        self._stripe = stripe    async def charge(self, amount: Money, customer: str) -> PaymentResult:        try:            charge = self._stripe.Charge.create(                amount=amount.cents, currency=amount.currency, customer=customer            )            return PaymentResult(success=True, transaction_id=charge.id)
Start here · InstructionsSKILL.md
architecture-patterns
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 2
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records3 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/advanced-patterns.mdFull text included
  • references/details.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/advanced-patterns.mdSupporting file
  • references/details.mdSupporting file

Operations mentioned in code and instructions

Read files
SKILL.md:72In the instructionsOpen original file
Detailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient.
Connect to websites
references/advanced-patterns.md:166In the instructionsOpen original file
    def __init__(self, base_url: str, http_client: httpx.AsyncClient):        self._base_url = base_url
Run commands
references/advanced-patterns.md:387In the instructionsOpen original file
```bash# Install: pip install pydeps
Install extra software packages
references/advanced-patterns.md:388In the instructionsOpen original file
```bash# Install: pip install pydepspydeps app --max-bacon=4 --cluster --rankdir=BT
Read keys or account settings
references/details.md:241In the instructionsOpen original file
class StripePaymentAdapter(PaymentGatewayPort):    def __init__(self, api_key: str):        import stripe
references/details.md:243In the instructionsOpen original file
        import stripe        stripe.api_key = api_key        self._stripe = stripe
Lines read
893
File checksum (to compare versions)
f70b8d622613f0e6eeed0a5d8cd75c3f0aa5d548dbc304a12f6e1f74c17faf7d