drawio
Pass
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
draw.iocommand-line utility to generate diagram exports (PNG, SVG, PDF, JPG). These commands are standard for the application and essential for the skill's function. No malicious command sequences or argument injections were detected. - [EXTERNAL_DOWNLOADS]: The installation guidelines refer to the official draw.io GitHub repository and Homebrew, which are well-known and trusted sources for software distribution. The skill does not download or execute scripts from unverified remote servers.
- [PROMPT_INJECTION]: The instructions are focused on diagram generation logic and layout rules. They do not contain patterns intended to bypass AI safety protocols, override core behavioral constraints, or extract system prompts.
- [DATA_EXFILTRATION]: There are no indicators of data exfiltration. The skill operates on user-provided diagram descriptions and manages the resulting files locally in the working directory without unauthorized network communication.
- [SAFE]: The skill includes a 'Self-Check' mechanism where it reads its own generated PNG files to verify and improve layout quality. While this represents a surface for indirect data processing, the risk is negligible as it occurs within a specialized workflow for visual refinement.
Audit Metadata