visual-explainer
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches font and script assets from well-known and trusted services, including Google Fonts and the jsDelivr CDN, to provide diagramming, charting, and animation capabilities within the generated HTML explanations.\n- [COMMAND_EXECUTION]: Utilizes Git operations such as
git diff,git show, andgit statusto retrieve technical context and repository history required for generating visual summaries.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from local repository files, git diffs, and implementation plans to generate its visual outputs.\n - Ingestion points: Data is read in
diff-review.md(git diffs and changed files),project-recap.md(repository history), andplan-review.md(implementation plans).\n - Boundary markers: Absent.\n
- Capability inventory: Writes HTML files to the
~/.agent/diagrams/directory, triggers browser activity, and utilizes thesurf-clitool for image generation.\n - Sanitization: Instructions recommend using
DOMParserandadoptNodeinstead ofinnerHTMLfor SVG injection to improve the security of the generated content.
Audit Metadata