Architecture Critic

• Analyzed: May 6, 2026, 1:11 PM
• Findings: 1
• Version: 1.1.1
• Hash: f0a606c696def6619fcdb5ae5a77f39b6d761cf07d3808a57a218a23d8503ea7
• Source: palm
• External report: View on VirusTotal

Findings (1)

The architecture-critic skill is a legitimate tool designed to perform adversarial architectural reviews using the Anthropic API. The core logic in scripts/run-critic.sh snapshots codebase metadata (file tree, dependencies, and recent commits) and sends it to an LLM to evaluate a task brief against provided security and architectural checklists. The implementation demonstrates high security awareness, including explicit prompt-injection defenses using XML-style delimiters (<untrusted_data>), strict API key format validation, and transparent data-handling documentation in SECURITY.md and clawhub.yaml. No malicious behaviors such as unauthorized data exfiltration, persistence, or command execution were found.