skills/connorads/dotfiles/c4-diagrams/Gen Agent Trust Hub

c4-diagrams

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/render.sh script is a utility that automates diagram rendering by executing local or containerized CLI tools. It supports multiple formats and utilizes standard tools like mmdc, d2, plantuml, and the structurizr CLI.
  • [EXTERNAL_DOWNLOADS]: The rendering script utilizes well-known services to fetch dependencies if they are not installed locally. It uses pnpm dlx to run @mermaid-js/mermaid-cli and official Docker images (plantuml/plantuml, structurizr/cli, structurizr/lite) for rendering. These are standard industry tools required for the skill's primary functionality.
  • [REMOTE_CODE_EXECUTION]: The skill uses pnpm dlx and docker run to execute rendering logic. These operations are scoped to the specific task of converting diagram source code (Mermaid, DSL, etc.) into visual assets and target official repositories.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a process for reverse-engineering architecture diagrams from existing codebases, which involves reading local project files.
  • Ingestion points: The skill reads project manifests (package.json, pom.xml), infrastructure definitions (Dockerfile, docker-compose.yml), and source code as described in references/deriving-from-code.md.
  • Boundary markers: The instructions in references/notation-and-quality.md explicitly require distinguishing between "Observed" evidence and "Inferred" guesses, and advise the agent to consult the user for clarification on ambiguous data.
  • Capability inventory: The scripts/render.sh script possesses the capability to execute shell commands and launch Docker containers to process the extracted models.
  • Sanitization: The skill relies on the agent's internal reasoning and manual human verification to ensure the integrity of the generated diagrams.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 08:41 PM
Security Audit — agent-trust-hub — c4-diagrams