c4-diagram-generator
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches diagram templates and utilizes remote rendering services.
- Fetches PlantUML C4 macros from the plantuml-stdlib repository on GitHub.
- Utilizes the Kroki.io service for remote diagram rendering via HTTP POST requests.
- [COMMAND_EXECUTION]: The skill invokes several external command-line tools to process and export diagrams.
- Executes
structurizr-clifor workspace export and DSL processing. - Invokes
mmdc(Mermaid CLI) for generating SVG, PNG, or PDF artifacts. - Runs
java -jar plantuml.jarfor local diagram rendering. - [INDIRECT_PROMPT_INJECTION]: The skill's feature to analyze source code for diagram generation creates an ingestion point for untrusted data.
- Ingestion points: The
analyzecommand reads files from the specified source directory as described inSKILL.mdandREADME.md. - Boundary markers: No explicit boundary markers or instructions to ignore embedded content are provided.
- Capability inventory: The skill utilizes Bash for tool execution, file system tools (Read, Write, Edit), and WebFetch for network access.
- Sanitization: No sanitization process for the ingested source code content is described.
Audit Metadata