statechart
Warn
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
tlc-to-chart.mjsdynamically loads a local JavaScript mapping file (.map.mjs) using theimport()function. This file is either generated by the skill or provided by the user to define state and step labels for the chart. - [EXTERNAL_DOWNLOADS]: The skill fetches the TLA+ Model Checker (TLC) from the official
tlaplus/tlaplusGitHub repository and Java from thetemurindistribution using themisetool manager. It also downloads thepeleand@resvg/resvg-jslibraries from the NPM registry. - [COMMAND_EXECUTION]: The skill invokes several external command-line tools using
child_process.spawnandspawnSync, includingjavato perform model checking,npmfor dependency installation, andmisefor environment management. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided TLA+ specifications and Mermaid diagrams. This data ingestion surface could potentially be used to embed instructions aimed at the agent, although the skill operates primarily as a standalone CLI tool.
Audit Metadata