improve-codebase-architecture

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:25 AM UTC
• Version: 1.0.10

Overview

The skill is a legitimate architecture-review aid, but it asks for broad project memory access and opens a generated report that runs third-party browser scripts.

Install only if you are comfortable with the agent reading cross-session project memory and producing a browser-opened HTML report that fetches Tailwind and Mermaid from public CDNs. Prefer reviewing or modifying the skill to remove `.claude/MEMORY.md` access, use local or static report assets, set Mermaid to strict mode, sanitize repository-derived content, and ask before opening files or changing `.claude/CONTEXT.md` or `.specs/`.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:40
• Finding: Mandatory Access to Cross-Session Agent Memory Violates Least Privilege<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:40-46` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code ```markdown This skill is _informed_ by the project's domain model. The domain language in `.claude/CONTEXT.md` and the cross-session context in `.claude/MEMORY.md` give names to good seams; approved architecture decisions in `docs/architecture/` record the constraints this skill should not re-litigate. ``` ```markdown Read the project's domain glossary (`.claude/CONTEXT.md`), cross-session memory (`.claude/MEMORY.md`), and approved architecture decisions in `docs/architecture/` (or `docs/adr/` if the project still uses them) that touch the area first. ``` ### Technical Analysis The Skill requires the agent to read `.claude/MEMORY.md` before performing an architecture review. Cross-session memory can contain prior conversation details, private project information, operational context, or user preferences unrelated to the code under review. The instruction does not: - Verify that memory access is necessary for the requested review. - Limit access to relevant sections. - Require user consent. - Prevent memory content from being included in subagent prompts or generated reports. - Treat persistent memory as untrusted data. This breaks least-privilege principles because architecture analysis can generally be performed using source files, domain documentation, and relevant architecture decisions without reading unrestricted cross-session state. ### Attack Path 1. Sensitive information from a previous session is stored in `.claude/MEMORY.md`. 2. A user invokes this Skill for an architecture review. 3. The Skill automatically instructs the agent to read the entire memory file. 4. The memory content enters the agent’s active context. 5. Relevant or accidentally selected content may be propagated into exploration reasoning, subagent briefs, or the generated HTML report. 6. I ...[truncated 601 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the default requirement to read `.claude/MEMORY.md`. 2. Restrict routine analysis to source files, `.claude/CONTEXT.md`, and architecture decisions relevant to the selected area. 3. If memory is genuinely required, request explicit user approval before reading it. 4. Allow users to identify specific memory sections rather than granting unrestricted access. 5. Treat all memory content as untrusted data and prevent it from becoming agent instructions. 6. Prohibit inclusion of memory content in subagent prompts or reports unless explicitly authorized. 7. Document exactly why memory access is necessary and what information will be retained or displayed. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/HTML-REPORT.md:3
• Finding: Generated Reports Execute Mutable JavaScript from External CDNs<![CDATA[ ## Vulnerability Details **File Location**: `references/HTML-REPORT.md:3-16` **Related Instruction**: `SKILL.md:60-62` **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: High ### Vulnerable Code ```markdown The architectural review is rendered as a single self-contained HTML file in the OS temp directory. Tailwind and Mermaid both come from CDNs. Mermaid handles graph-shaped diagrams reliably; hand-built divs and inline SVG handle the more editorial visuals (mass diagrams, cross-sections). Mix the two — don't lean on Mermaid for everything, it'll start to look generic. ``` ```html <!doctype html> <html lang="en"> <head> <meta charset="utf-8" /> <title>Architecture review — {{repo name}}</title> <script src="https://cdn.tailwindcss.com"></script> <script type="module"> import mermaid from "https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs"; mermaid.initialize({ startOnLoad: true, theme: "neutral", securityLevel: "loose" }); </script> ``` The report-generation instruction additionally states: ```markdown Write a self-contained HTML file to the OS temp directory so nothing lands in the repo. Resolve the temp dir from `$TMPDIR`, falling back to `/tmp` (or `%TEMP%` on Windows), and write to `<tmpdir>/architecture-review-<timestamp>.html` so each run gets a fresh file. Open it for the user — `xdg-open <path>` on Linux, `open <path>` on macOS, `start <path>` on Windows — and tell them the absolute path. The report uses **Tailwind via CDN** for layout and styling, and **Mermaid via CDN** for diagrams where a graph/flow/sequence reliably communicates the structure. ``` ### Technical Analysis The generated local HTML report executes JavaScript fetched at viewing time from public CDN URLs. The Tailwind URL has no version pin, and Mermaid is pinned only to major version `11`, allowing the effective code to change after the Skill has been reviewed. No Subresource Integrit ...[truncated 1610 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer a script-free static HTML report using locally generated CSS and SVG. 2. If Mermaid is necessary, bundle a reviewed version locally with the Skill rather than fetching it at viewing time. 3. Pin dependencies to exact immutable versions instead of floating URLs or major-version ranges. 4. Verify bundled assets with cryptographic hashes during release preparation. 5. Where browser support permits, use Subresource Integrity and an explicit `crossorigin` policy. 6. Add a restrictive Content Security Policy that denies unapproved scripts, network requests, frames, plugins, and object embedding. 7. Do not automatically open a report that requires remote executable content; ask for user confirmation. 8. Accurately describe reports with external dependencies rather than calling them self-contained. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/HTML-REPORT.md:61
• Finding: Untrusted Repository Data Is Rendered with Mermaid Loose Security<![CDATA[ ## Vulnerability Details **File Location**: `references/HTML-REPORT.md:61-73` **Security Configuration**: `references/HTML-REPORT.md:13-16` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```html <script src="https://cdn.tailwindcss.com"></script> <script type="module"> import mermaid from "https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs"; mermaid.initialize({ startOnLoad: true, theme: "neutral", securityLevel: "loose" }); </script> ``` ```markdown ### Mermaid graph (the workhorse for dependencies / call flow) Use a Mermaid `flowchart` or `graph` when the point is "X calls Y calls Z, and look at the mess." Wrap it in a Tailwind-styled card so it doesn't feel parachuted in. Style with classDef to colour leakage edges red and the deep module dark. Sequence diagrams work well for "before: 6 round-trips; after: 1." ```html <div class="rounded-lg border border-slate-200 bg-white p-4"> <pre class="mermaid"> flowchart LR A[OrderHandler] --> B[OrderValidator] B --> C[OrderRepo] C -.leak.-> D[PricingClient] classDef leak stroke:#dc2626,stroke-width:2px; class C,D leak </pre> </div> ``` ``` ### Technical Analysis The report contains repository-derived module names, file paths, domain vocabulary, and architectural descriptions. The instructions do not require HTML escaping, attribute encoding, Mermaid-label quoting, URL validation, directive filtering, or sanitization before inserting those values into the generated document. Mermaid is explicitly initialized with `securityLevel: "loose"`. This mode permits more permissive rendering behavior than strict mode and is inappropriate when diagram source may contain attacker-influenced repository text. There are two relevant injection surfaces: 1. Dynamic content inserted into ordinary HTML without contextual escaping. 2. Dynamic content inserted into Mermaid source without Mermaid-specific san ...[truncated 1369 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Change Mermaid initialization to `securityLevel: "strict"`. 2. HTML-escape every repository-derived value inserted into text nodes. 3. Apply context-specific encoding for HTML attributes, URLs, CSS, SVG, and script-adjacent contexts. 4. Generate internal Mermaid node identifiers independently of repository names. 5. Quote and sanitize all Mermaid labels before rendering them. 6. Reject or neutralize Mermaid directives, links, callbacks, raw HTML labels, and other active syntax in repository-derived text. 7. Use a well-maintained HTML sanitizer with a restrictive allowlist if generated markup must be processed. 8. Add a restrictive Content Security Policy, including denial of inline scripts and unapproved network destinations. 9. Render untrusted names as plain text whenever possible instead of embedding them in Mermaid syntax. 10. Save the report first and require user confirmation before opening it. 11. Add security tests using repository names and paths containing HTML terminators, quotes, Mermaid directives, URLs, and script-like content. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to write an HTML file to disk and open it with a platform launcher, but gives no prior warning or consent checkpoint. Silent filesystem writes plus automatic opening of a browser/application can surprise users, trigger unintended execution contexts, and expose them to locally rendered active content.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly requires loading Tailwind and Mermaid from external CDNs, which introduces unnecessary outbound network access during a local architecture review. This expands the trust boundary to third-party infrastructure, can leak metadata, and creates a supply-chain/script-injection risk if the CDN content changes or is compromised.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The instructions explicitly require asking the user in Portuguese after the report is written. This forces a specific language for user-facing output without opt-in, even though the skill is otherwise described for both English and Portuguese usage.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs repository modifications to `.claude/CONTEXT.md` and creation of `.specs/` files during the conversation without an upfront warning that the analysis may change tracked project files. In a code-assistance context, undisclosed writes to repo state can cause integrity, review, and workflow issues even if the content is well-intentioned.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill is described as an architecture-review aid, but later instructs the agent to modify project context files and create new SPEC documents. That scope expansion turns a read/analyze workflow into a write-capable workflow, increasing the chance of unintended repository changes and making the skill materially more dangerous than its headline purpose suggests.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The report format explicitly requires loading Tailwind and Mermaid from external CDNs even though the skill's purpose is to generate a local architecture review. That creates unnecessary outbound network access, leaks metadata about local usage, and introduces supply-chain risk if the CDN content changes or is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Mermaid is initialized with `securityLevel: "loose"`, which weakens Mermaid's built-in HTML/script safety restrictions. In a reporting skill that may render repository-derived content into diagrams, this raises the risk of HTML injection or script-adjacent content being interpreted in the generated report.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The tone section requires 'Plain English' and further enforces exact wording and banned substitutes, effectively forcing a specific language/style without user opt-in. Under the policy, language constraints should either offer user choice or be clearly justified as region- or compliance-specific.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The document instructs the agent to load third-party CDN resources but provides no user-facing disclosure that generating the report will trigger network access. In this skill context, users would reasonably expect a local architecture review artifact, so silent network use can violate privacy and trust expectations.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: This markdown file instructs users to 'Use these terms exactly' and forbids substitutes, which imposes a language policy on all suggestions generated by the skill. Under the policy-violation category, forcing a specific language or vocabulary without user opt-in is in scope.

Static analysis

No suspicious patterns detected.