generate-flow-diagram
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled shell script (
scripts/check-mermaid.sh) to perform syntax validation on generated Mermaid diagrams. - [EXTERNAL_DOWNLOADS]: The validation script may download and run the
@mermaid-js/mermaid-clipackage from the official NPM registry usingnpxif the tool is not already installed locally. This uses a well-known service for legitimate validation purposes. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted external inputs, including user-supplied process specifications, existing diagrams, and documentation from the web. To mitigate risks of malicious instructions embedded in these sources, the skill instructions across multiple files (e.g.,
SKILL.md,references/input-contract.md) explicitly mandate treating such content as data rather than instructions and provide clear boundary instructions for the model to follow.
Audit Metadata