legal-visualization
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script 'scripts/export_drawio.py' uses 'subprocess.run' to call the 'drawio' or 'diagrams.net' desktop CLI. This is used solely for exporting '.drawio' files into '.svg', '.png', and '.pdf' formats. The commands are constructed using argument lists rather than shell strings, preventing typical command injection vulnerabilities.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided legal case materials to generate diagrams, which represents an attack surface for indirect prompt injection. However, the skill provides specific 'Hard Constraints' (硬约束) in 'SKILL.md' and automated verification via 'scripts/validate_drawio.py' to ensure that only facts explicitly present in the source material are used, mitigating the risk of instructions embedded in data being followed as commands.
Audit Metadata