architecture-navigator

The bash scanner runs local commands such as find, basename, wc, and date against a supplied project root. This is legitimate architecture discovery, with quoted path variables and no network calls found, but it still executes shell commands and reads local filesystem structure. Verdict: true positive for local command execution. Confidence: 0.84. Confidence reasoning: executable shell commands are directly present, while semantic review shows bounded architecture-scanning intent.

The skill documentation tells the assistant to run the architecture scanner and includes ls, find, and grep examples. These commands are relevant to codebase navigation and validation, but they increase operational risk because an AI agent may execute them in a user workspace. Verdict: true positive with legitimate use. Confidence: 0.78. Confidence reasoning: the instructions explicitly request local command execution, but no malicious command, network endpoint, or secret collection was found.