process-flow-diagram
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches external assets including typography from Google Fonts (
fonts.googleapis.com) and utility scripts from the jsDelivr CDN (cdn.jsdelivr.net). - [EXTERNAL_DOWNLOADS]: The implementation of third-party JavaScript libraries follows security best practices by utilizing Subresource Integrity (SRI) hashes (
sha384-ZZ1pncU3bQe8y31yfZdMFdSpttDoPmOZg2wguVK9almUodir1PghgT0eY7Mrty8Hfor html2canvas andsha384-en/ztfPSRkGfME4KIm05joYXynqzUgbsG5nMrj/xEFAHXkeZfO3yMK8QQ+mP7p1/for jsPDF), which prevents execution if the remote files are tampered with. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied text (workflow steps, labels, and descriptions) to populate an HTML/SVG template. This represents a standard ingestion surface for untrusted data, though the risk is mitigated by the specific utility of the skill and the output being a static file meant for browser rendering.
Audit Metadata