workflow-diagram

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: No security issues detected. The skill's operations, including codebase exploration and external rendering, are consistent with its stated purpose of generating workflow diagrams. The use of the Mermaid Chart MCP tool for rendering is a legitimate use of a well-known service.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests codebase data to create visualizations, which is an inherent part of its functionality. While this provides a theoretical injection surface, it is consistent with the primary skill purpose.
  • Ingestion points: Codebase exploration via cartograph:codebase-explorer as described in SKILL.md.
  • Boundary markers: No explicit delimiters or warnings to ignore embedded instructions are present in the processing instructions.
  • Capability inventory: The skill calls the mcp__claude_ai_Mermaid_Chart__validate_and_render_mermaid_diagram tool to render generated content.
  • Sanitization: No explicit sanitization or validation of the ingested codebase content is specified before interpolation into the rendering tool prompt.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 10:06 AM