drawio-academic-skills
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses the Bash tool to execute a local Node.js CLI script (
../drawio/scripts/cli.js). This is a standard interaction with its documented sibling dependency and does not involve arbitrary command injection or untrusted remote execution. - [SAFE]: Data processing is limited to generating YAML specifications and visual diagram artifacts (SVG, PNG, Draw.io) based on user-provided descriptions. There are no attempts to access sensitive system files or exfiltrate data to external domains.
- [SAFE]: The instructions establish a strict operational contract for the agent (e.g., offline-first, YAML-first) that aligns with academic publication workflows. No prompt injection or safety bypass patterns were detected.
- [SAFE]: No obfuscated code, hidden URLs, or persistence mechanisms are present in the skill files or metadata.
Audit Metadata