Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

Agent skill · Audited from source

brooks-lint

skill · hyhmrright/brooks-lintMIT licenceAudited 16 Oct 2026 · source 7268d322e836

★ 1,530pushed today
✕BLOCKGrade D · 69/100 · 23 findings · 7268d32
1,530repo stars · whole hyhmrright/brooks-lint
Read the findingsView source on GitHub ↗

Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 7268d322e836 and observed network access and no hard-coded secrets. The audit raised 23 findings, 1 critical or high. What it does: Architecture audit that maps module dependencies, checks layering integrity, and flags structural decay across a codebase, drawing on twelve classic engineering books. Triggers when: user asks to audit architecture,…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “brooks-lint (hyhmrright/brooks-lint)”. Retrieved 16 Oct 2026. https://modelsatlas.com/skills/hyhmrright/brooks-lint

Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 1 critical or high finding, starting with “Prompt injection” in SECURITY.md:14. Do not install it without reading them.

Trust audit

Audit 0.4.1 · source read 16 Oct 2026

Trust score69/100✕BLOCK D
0 critical1 high11 medium11 low0 info

BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 642 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkDeclared1 observation
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityWARN8
L1 Static sourceSecrets, path traversal, supply chain, hidden codeWARN6
L2 InstructionsPrompt injection, authority framing, hidden directivesFAIL9
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: instruction override, no behavioural pass.

Findings (23)

HIGHPrompt injectionprompt.override · SECURITY.md:14
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
If you believe a skill prompt could be crafted to cause Claude to behave in a harmful or unintended way (prompt injection via malicious code input, jailbreak vectors in skill instructions, etc.), plea
Why
asks the agent to drop prior instructions or safety
Fix
remove the instruction
MEDIUMInventory / provenanceinv.binary · scripts/sarif.mjs
F-13 Inventory / provenanceCWE-1104Layer L0
sarif.mjs
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
MEDIUMObfuscation / stealthobf.base64_blob · evals/results/pilot2-04-tradeoff-composition-root/traces/with.jsonl:6
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
{"type":"assistant","message":{"model":"claude-sonnet-5","id":"msg_011Cf3NoB6pbW4HdJnpBrVxs","type":"message","role":"assistant","content":[{"type":"thinking","thinking":"","signature":"EqYDCqgBCBEYAi
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.base64_blob · evals/results/pilot2-04-tradeoff-composition-root/traces/with.jsonl:13
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
{"type":"assistant","message":{"model":"claude-sonnet-5","id":"msg_011Cf3NoSXGbL62G6DEC36Zo","type":"message","role":"assistant","content":[{"type":"thinking","thinking":"","signature":"EqsCCqgBCBEYAi
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.base64_blob · evals/results/pilot2-04-tradeoff-composition-root/traces/with.jsonl:25
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
{"type":"assistant","message":{"model":"claude-sonnet-5","id":"msg_011Cf3NoesgBKx1ERVMbGf3V","type":"message","role":"assistant","content":[{"type":"thinking","thinking":"","signature":"EqsGCqgBCBEYAi
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.base64_blob · evals/results/pilot2-04-tradeoff-composition-root/traces/with.jsonl:154
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
{"type":"assistant","message":{"model":"claude-sonnet-5","id":"msg_011Cf3Noxwrgar6sUnp7efxG","type":"message","role":"assistant","content":[{"type":"thinking","thinking":"","signature":"EsHAAgqoAQgRGA
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.base64_blob · evals/results/pilot2-04-tradeoff-composition-root/traces/without.jsonl:34
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
{"type":"assistant","message":{"model":"claude-sonnet-5","id":"msg_011Cf3No9xMu1wGumFyeggjs","type":"message","role":"assistant","content":[{"type":"thinking","thinking":"","signature":"EutPCqgBCBEYAi
Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.hidden_file · .brooks-lint.example.yaml
F-13 Inventory / provenanceCWE-1104Layer L0
.brooks-lint.example.yaml
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · docs/.nojekyll
F-13 Inventory / provenanceCWE-1104Layer L0
.nojekyll
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWFilesystem / pathfs.traversal · .github/actions/brooks-lint/action.yml:71
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
root="$(cd "$GITHUB_ACTION_PATH/../../.." && pwd)"
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainprompt.pipe_to_shell · CHANGELOG.md:443
F-08 Supply chainCWE-829 · CWE-1357Layer L2
`curl ... | bash -s -- <platform>`; `--project` targets the current repo.
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainprompt.pipe_to_shell · README.es.md:73
F-08 Supply chainCWE-829 · CWE-1357Layer L2
curl -fsSL https://raw.githubusercontent.com/hyhmrright/brooks-lint/main/scripts/install.sh | bash -s -- <platform>
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainprompt.pipe_to_shell · README.es.md:283
F-08 Supply chainCWE-829 · CWE-1357Layer L2
curl -fsSL https://raw.githubusercontent.com/hyhmrright/brooks-lint/main/scripts/install.sh | bash -s -- <platform>
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainprompt.pipe_to_shell · README.ja.md:73
F-08 Supply chainCWE-829 · CWE-1357Layer L2
curl -fsSL https://raw.githubusercontent.com/hyhmrright/brooks-lint/main/scripts/install.sh | bash -s -- <platform>
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainprompt.pipe_to_shell · README.ja.md:283
F-08 Supply chainCWE-829 · CWE-1357Layer L2
curl -fsSL https://raw.githubusercontent.com/hyhmrright/brooks-lint/main/scripts/install.sh | bash -s -- <platform>
Why
No further detail recorded for this rule.
Fix
—
LOWPrompt injectionprompt.transfer_instruction · evals/results/pilot2-01-pr29-provider-remap/report.html:419
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- If the dev&apos;s shell *does* have `ANTHROPIC_API_KEY` set (common for local dev), running with `--provider examplegw` will silently send their **real Anthropic key** to `api.examplegw.example` ins
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionprompt.transfer_instruction · evals/results/pilot2-01-pr29-provider-remap/report.html:457
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- If the dev&apos;s shell *does* have `ANTHROPIC_API_KEY` set (common for local dev), running with `--provider examplegw` will silently send their **real Anthropic key** to `api.examplegw.example` ins
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionprompt.transfer_instruction · evals/results/pilot2-01-pr29-provider-remap/report.html:502
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- If the dev&apos;s shell *does* have `ANTHROPIC_API_KEY` set (common for local dev), running with `--provider examplegw` will silently send their **real Anthropic key** to `api.examplegw.example` ins
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine

Audit 0.4.1 · source sha 7268d322e836 · 16 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherhyhmrright GitHub userOwner of the repository this skill is read from
  • Source folderhyhmrright/brooks-lintThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict7268d322e836A new audit runs when the source changes
  • Repository statusNot archivedPushed today
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Architecture audit that maps module dependencies, checks layering integrity, and flags structural decay across a codebase, drawing on twelve classic engineering books. Triggers when: user asks to audit architecture,…

---
name: brooks-audit
description: >
  Architecture audit that maps module dependencies, checks layering integrity, and
  flags structural decay across a codebase, drawing on twelve classic engineering books.
  Triggers when: user asks to audit architecture, review folder/module structure,
  check for circular imports, understand how the codebase is organized, or asks
  "does this follow clean architecture?" or "why does everything depend on everything?".
  Also triggers for onboarding requests: "explain this codebase to a new developer"
  or "give me a codebase tour" (use onboarding mode).
  Do NOT trigger for: PR-level code review (use brooks-review) or line-level refactoring
  questions — this skill analyzes structural/module-level concerns, not individual functions.
metadata:
  opencode/slash: "true"
---

# Brooks-Lint — Architecture Audit

## Setup

Read in order:

1. `../_shared/common.md` — Iron Law, Project Config, Report Template, Health Score
2. `../_shared/source-coverage.md` — book coverage, exceptions, tradeoffs
3. `../_shared/decay-risks.md` — symptom definitions and source attributions
4. `architecture-guide.md` (this directory) — the audit framework

## Process

**Onboarding mode:** If the user asks for an onboarding report, codebase tour, or
"explain this codebase to a new developer", read `onboarding-guide.md` from this
directory and follow it instead of `architecture-guide.md`. This mode explains rather
than diagnoses — no Health Score, no Iron Law findings.

**Scope:** if the user did not specify files or a directory, apply Auto Scope Detection
(`../_shared/common.md`) first.

1. Gather codebase context and draw the module dependency graph as Mermaid (Steps 0–1 of the guide)
2. Scan for each decay risk in the order specified (Steps 2–4 of the guide)
3. Assign node colors in the Mermaid diagram based on findings (red/yellow/green) — after Step 4
4. Run the Testability Seam Assessment (Step 5 of the guide)
5. Run the Conway's Law check (Step 6 of the guide)
6. Output using the Report Template from common.md — Mermaid graph FIRST, then Findings

**Mode line in report:** `Architecture Audit`

Excerpt, first 2,145 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 7268d32

git clone https://github.com/hyhmrright/brooks-lint
git -C brooks-lint checkout 7268d322e836

The author documents no install command, so this uses the repository directly. Our verdict covers commit 7268d322e836 only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
CodexMentioned in its text, not testedSkills for Codex · About Codex
GitHub CopilotMentioned in its text, not testedSkills for GitHub Copilot · About GitHub Copilot
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
Gemini CLIMentioned in its text, not testedSkills for Gemini CLI · About Gemini CLI
WindsurfMentioned in its text, not testedSkills for Windsurf · About Windsurf
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✕BLOCK D 69 / 100

    first audit · source 7268d322e836

README badge

For maintainers · shows the latest audit

ModelsAtlas: BLOCK DMODELSATLASBLOCK · D 
[![ModelsAtlas: BLOCK D](https://modelsatlas.com/skills/hyhmrright/brooks-lint/badge.svg)](https://modelsatlas.com/skills/hyhmrright/brooks-lint/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Similar skills

All coding & review skills →
Brooks Review!CAUTION

hyhmrright/brooks-lint

PR code review that surfaces decay risks, design smells, and maintainability issues with concrete Symptom → Source → Consequence → Remedy findings, drawing on twelve classic engineering books. Triggers when: user asks…

★ 1.5kGrade B
Brooks Audit!CAUTION

hyhmrright/brooks-lint

Architecture audit that maps module dependencies, checks layering integrity, and flags structural decay across a codebase, drawing on twelve classic engineering books. Triggers when: user asks to audit architecture,…

★ 1.5kGrade B
Brooks Debt!CAUTION

hyhmrright/brooks-lint

Tech debt assessment that identifies, classifies, and prioritizes maintainability problems — helping teams build a refactoring roadmap — drawing on twelve classic engineering books. Triggers when: user asks about tech…

★ 1.5kGrade B
Brooks Health!CAUTION

hyhmrright/brooks-lint

Combined codebase health dashboard that scores a project across all four quality dimensions — PR quality, architecture, tech debt, and test quality — in a single pass, drawing on twelve classic engineering books.…

★ 1.5kGrade B
Brooks Sweep!CAUTION

hyhmrright/brooks-lint

Full-sweep mode: runs a unified analysis across all quality dimensions — code decay, architecture, tech debt, and test quality — then applies fixes directly to the codebase. Safe changes are auto-applied; risky changes…

★ 1.5kGrade B
Brooks Test!CAUTION

hyhmrright/brooks-lint

Test quality review drawing on twelve classic engineering books — with primary focus on xUnit Test Patterns, The Art of Unit Testing, How Google Tests Software, and Working Effectively with Legacy Code — that diagnoses…

★ 1.5kGrade B

Add this badge to your README

[![ModelsAtlas: BLOCK D](https://modelsatlas.com/skills/hyhmrright/brooks-lint/badge.svg)](https://modelsatlas.com/skills/hyhmrright/brooks-lint/)

Questions about brooks-lint

What does the brooks-lint skill do?
AI code reviews grounded in 12 classic engineering books — decay risk diagnostics with book citations, severity labels, and 6 analysis modes including full-sweep auto-fix
Is brooks-lint safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What can brooks-lint access on my machine?
The audit observed that it reaches the network. Each of those is consistent with what it says it does. Secrets in the source: none found.
Which assistants does brooks-lint work with?
Its documentation mentions claude-code, codex, copilot, cursor, gemini-cli and windsurf. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (7268d322e836), read on 2026-10-16. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.