diagram-composer
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a local Node.js script located at
scripts/render-diagram.mjsto perform diagram rendering tasks. This script is used for converting source files (like Mermaid, Excalidraw, or Graphviz) into output formats like SVG, PNG, or PDF. The execution is scoped to the primary purpose of the skill and follows standard development patterns. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text or structures to generate diagram source code. It includes specific composition rules and an output checklist that instructs the agent to validate syntax and visually inspect output, which helps mitigate risks associated with processing untrusted data.
- Ingestion points: User-supplied text converted into diagram source files (SKILL.md).
- Boundary markers: None explicitly defined in the prompt interpolation.
- Capability inventory: Local command execution via
node scripts/render-diagram.mjs(SKILL.md). - Sanitization: Instructions specify that the agent should validate syntax and inspect visual output for syntax errors or layout issues.
Audit Metadata