graphviz
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/render.pyinvokes Graphviz layout binaries (e.g.,dot,neato,fdp) to render diagrams. - The script utilizes
subprocess.runwith an argument list, which is a secure implementation that prevents shell injection vulnerabilities. - The layout engine selection is restricted to a specific allowlist of choices (
dot,neato,fdp,sfdp,twopi,circo), and the output formats are restricted tosvg,png, orpdf. - The script allows the agent to specify input and output file paths, which is the intended functional behavior for a rendering utility.
Audit Metadata