visual-recap
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill generates HTML artifacts that optionally load the Mermaid diagramming library from the JSDelivr CDN (
https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs). This is a well-known service used for documentation and diagram rendering. - [COMMAND_EXECUTION]: The skill uses a provided Bash script (
references/sidecar.sh) and standard Git commands (git diff,git log,git show) to extract repository history and state. These operations are standard for development-oriented agent skills. - [DYNAMIC_EXECUTION]: The skill generates interactive HTML files containing CSS and small JavaScript snippets for theme toggling and UI interactions. The logic for these interactions is explicitly provided in the skill's reference files (
references/visual-recap-design.md). - [DATA_EXPOSURE]: The skill extracts data from the local repository (code hunks, file paths) to render the visual recap. It includes a mandatory 'Secret Redaction' rule (
references/visual-rendering-core.md§2) that instructs the agent to mask credentials, keys, and tokens before they reach the generated HTML artifact.
Audit Metadata