visual-planner
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The playground server (scripts/playground_server.ts) fetches required dependencies from the public npm registry during initialization if they are missing from the local environment.
- [COMMAND_EXECUTION]: The skill spawns local processes to run a Next.js development server and automatically opens the user's default web browser to provide the interactive diagramming interface.
- [DYNAMIC_EXECUTION]: The diagram creation utility (scripts/create_diagram.ts) uses dynamic imports to load its own tldraw schema and utility dependencies from the local node_modules directory.
- [INDIRECT_PROMPT_INJECTION]: The skill provides functions to read and parse diagram metadata from .tldr files, creating a surface for indirect injection. Ingestion points: scripts/create_diagram.ts, stats.ts, and validate.ts read diagram state from JSON files. Boundary markers: Absent, content is processed as structured JSON. Capability inventory: Local command execution for servers and file writing. Sanitization: scripts/validate.ts performs schema validation on the planning metadata.
Audit Metadata