Skills architecture-navigator

📦

architecture-navigator

Name: architecture-navigator
Author: ArieGoldkin

Content revision r2 High Risk ⚙️ External commands📁 Filesystem access

Navigate DevPrep AI Architecture

Developers can lose time deciding where code belongs in DevPrep AI. This skill maps the structure and applies documented placement rules.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "architecture-navigator" from https://skillstore.io/skills/ariegoldkin-architecture-navigator.md and its manifest at https://skillstore.io/api/skills/ariegoldkin-architecture-navigator/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/ariegoldkin-architecture-navigator.md Signed manifest GET /api/skills/ariegoldkin-architecture-navigator/manifest Signed lockfile GET /api/skills/ariegoldkin-architecture-navigator/lockfile

Test it

Using "architecture-navigator". Where should OAuth authentication go?

Expected outcome:

Place authentication behavior in modules/auth/oauth. Put the external OAuth client wrapper in lib/oauth because it integrates with a third-party service.

Using "architecture-navigator". Map the current architecture.

Expected outcome:

The repository uses seven source folders for routes, features, shared code, integrations, state, types, and styles.
The map lists each feature module with TypeScript file counts.
Key locations identify the API layer, store slices, and shared components.

Using "architecture-navigator". Where should a global toast system go?

Expected outcome:

Place the reusable toast component and hook under shared. Keep application-wide toast state in store and preserve the allowed dependency direction.

Security Audit

High Risk

v9 • 7/23/2026 Open versioned report

All 68 static findings are false positives caused by Markdown syntax or expected read-only shell operations. The scanner does not write files or access the network. Semantic review found one shell injection example and one indirect prompt injection channel involving repository-controlled names.

Files scanned

659

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:86

Shell Injection Through Module Directory Names

The module discovery example inserts find output into sh -c source text. A crafted directory name can break quoting and execute arbitrary shell commands.

GNU find replaces braces inside the shell source argument. Repository-controlled quotes or command substitutions in a directory name can become executable syntax.

Medium

SKILL.md:16-37 scripts/scan_architecture.sh:32-36 scripts/scan_architecture.sh:67-70

Indirect Prompt Injection Through Scanner Output

The workflow consumes scanner output, while the scanner prints repository-controlled names without escaping. Crafted names can place instruction-like text into model context.

The data flow from repository-controlled names to model-facing Markdown is explicit. Exploitation requires a crafted repository name and unsafe treatment of output as instructions.

Risk Factors

⚙️ External commands (50)

📁 Filesystem access (3)

scripts/scan_architecture.sh:94 SKILL.md:22 SKILL.md:245

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/ariegoldkin-architecture-navigator/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/ariegoldkin-architecture-navigator/security.svg)](https://skillstore.io/skills/ariegoldkin-architecture-navigator?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/ariegoldkin-architecture-navigator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ariegoldkin-architecture-navigator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/ariegoldkin-architecture-navigator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

ArieGoldkin. (2026). architecture-navigator security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/ariegoldkin-architecture-navigator/audits/9

BibTeX citation

@techreport{ariegoldkin-ariegoldkin-architecture-navigator-2026,
  author = {ArieGoldkin},
  title = {architecture-navigator security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/ariegoldkin-architecture-navigator/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "architecture-navigator security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "ArieGoldkin"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/ariegoldkin-architecture-navigator/audits/9"
identifiers:
  - type: other
    value: "skillstore:ariegoldkin-architecture-navigator:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Place a New Feature

Choose exact folders for feature logic, reusable components, integrations, state, and shared types.

Review Architecture Drift

Compare current modules and imports with the documented seven-folder responsibilities.

Build Repository Context

Generate a compact structure map before planning or implementing a development task.

Try These Prompts

Map the Repository

Scan the current DevPrep AI architecture. Summarize the seven folders, feature modules, key locations, and file counts.

Place New Code

I need to add [feature]. Recommend exact paths for its logic, UI, state, integrations, and types. Explain each placement rule.

Validate Organization

Review [area] against the documented folder and import rules. List confirmed violations, evidence, and specific moves or import changes.

Design Cross-Cutting Changes

Design the placement and dependency flow for [complex feature]. Separate domain code, reusable elements, external integrations, global state, and shared types.

Best Practices

Run the scanner before recommendations when repository structure may have changed.
Provide exact paths and cite the placement rule behind every recommendation.
Verify import direction after moving code between architectural folders.