visual-explainer

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches font and script assets from well-known and trusted services, including Google Fonts and the jsDelivr CDN, to provide diagramming, charting, and animation capabilities within the generated HTML explanations.\n- [COMMAND_EXECUTION]: Utilizes Git operations such as git diff, git show, and git status to retrieve technical context and repository history required for generating visual summaries.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from local repository files, git diffs, and implementation plans to generate its visual outputs.\n
  • Ingestion points: Data is read in diff-review.md (git diffs and changed files), project-recap.md (repository history), and plan-review.md (implementation plans).\n
  • Boundary markers: Absent.\n
  • Capability inventory: Writes HTML files to the ~/.agent/diagrams/ directory, triggers browser activity, and utilizes the surf-cli tool for image generation.\n
  • Sanitization: Instructions recommend using DOMParser and adoptNode instead of innerHTML for SVG injection to improve the security of the generated content.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 02:01 PM