workflow-state-machine-simulation
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a workflow for generating visualization artifacts (Mermaid state diagrams and interactive HTML files) without executing the target source code, ensuring a clear separation between modeling and execution.
- [SAFE]: The interactive HTML component is designed to be self-contained, using native browser APIs and SVG for rendering. It explicitly avoids external dependencies, network requests, and dangerous functions like
eval()orFunction()constructors. - [SAFE]: Data handling instructions follow security best practices by treating target-derived strings as untrusted data and requiring safe injection into the DOM using
textContentor equivalent APIs to prevent cross-site scripting (XSS). - [SAFE]: Potential indirect prompt injection risks from processing external target files are mitigated by clear instructions to model the source authoritatively without executing it and to sanitize all displayed content.
- [SAFE]: The generation process enforces template invariance for the HTML artifact, ensuring that only declarative machine data is updated while the underlying visualization logic remains static and verified.
Audit Metadata