excalidraw
Pass
Audited by Gen Agent Trust Hub on Mar 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Node.js script (render.mjs) to process diagram data and generate visual outputs. This execution is limited to the skill's own logic and the local environment.
- [EXTERNAL_DOWNLOADS]: The skill requires standard packages from the NPM registry, including roughjs, @resvg/resvg-js, and @xmldom/xmldom. These are well-known, legitimate libraries used for SVG rendering and image conversion.
- [DATA_EXPOSURE]: Diagrams are saved to a user-configurable local directory, and temporary data is stored in /tmp during the rendering process. This is a common and acceptable pattern for local file-based tools.
Audit Metadata