Security audit

Source To Architecture

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent local source-code-to-architecture tool, but it asks for under-specified repository automation and its installer can overwrite local Docker configuration.

Review before installing. Use the one-time source analysis and diagram generation only on repositories you intend to inspect, and avoid allowing Git hooks, weekly sync, or commit-triggered automation unless you define the exact repository, files, schedule, and removal process. Run the installer from a controlled directory because it can change system/global tools and overwrite a Dockerfile in the current directory.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script unconditionally writes a Dockerfile in the current directory using shell redirection, which will overwrite any existing Dockerfile without prompting or backing it up. In a development repository this can destroy build configuration or cause users to unknowingly replace trusted container definitions with generated content.

Static analysis

No suspicious patterns detected.