skills/backnotprop/pstack/statechart/Gen Agent Trust Hub

statechart

Warn

Audited by Gen Agent Trust Hub on Oct 24, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script tlc-to-chart.mjs dynamically loads a local JavaScript mapping file (.map.mjs) using the import() function. This file is either generated by the skill or provided by the user to define state and step labels for the chart.
  • [EXTERNAL_DOWNLOADS]: The skill fetches the TLA+ Model Checker (TLC) from the official tlaplus/tlaplus GitHub repository and Java from the temurin distribution using the mise tool manager. It also downloads the pele and @resvg/resvg-js libraries from the NPM registry.
  • [COMMAND_EXECUTION]: The skill invokes several external command-line tools using child_process.spawn and spawnSync, including java to perform model checking, npm for dependency installation, and mise for environment management.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided TLA+ specifications and Mermaid diagrams. This data ingestion surface could potentially be used to embed instructions aimed at the agent, although the skill operates primarily as a standalone CLI tool.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 24, 2026, 01:52 AM