workflow-diagram
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues detected. The skill's operations, including codebase exploration and external rendering, are consistent with its stated purpose of generating workflow diagrams. The use of the Mermaid Chart MCP tool for rendering is a legitimate use of a well-known service.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests codebase data to create visualizations, which is an inherent part of its functionality. While this provides a theoretical injection surface, it is consistent with the primary skill purpose.
- Ingestion points: Codebase exploration via
cartograph:codebase-exploreras described inSKILL.md. - Boundary markers: No explicit delimiters or warnings to ignore embedded instructions are present in the processing instructions.
- Capability inventory: The skill calls the
mcp__claude_ai_Mermaid_Chart__validate_and_render_mermaid_diagramtool to render generated content. - Sanitization: No explicit sanitization or validation of the ingested codebase content is specified before interpolation into the rendering tool prompt.
Audit Metadata