c4-diagrams
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/render.shscript is a utility that automates diagram rendering by executing local or containerized CLI tools. It supports multiple formats and utilizes standard tools likemmdc,d2,plantuml, and thestructurizrCLI. - [EXTERNAL_DOWNLOADS]: The rendering script utilizes well-known services to fetch dependencies if they are not installed locally. It uses
pnpm dlxto run@mermaid-js/mermaid-cliand official Docker images (plantuml/plantuml,structurizr/cli,structurizr/lite) for rendering. These are standard industry tools required for the skill's primary functionality. - [REMOTE_CODE_EXECUTION]: The skill uses
pnpm dlxanddocker runto execute rendering logic. These operations are scoped to the specific task of converting diagram source code (Mermaid, DSL, etc.) into visual assets and target official repositories. - [INDIRECT_PROMPT_INJECTION]: The skill defines a process for reverse-engineering architecture diagrams from existing codebases, which involves reading local project files.
- Ingestion points: The skill reads project manifests (
package.json,pom.xml), infrastructure definitions (Dockerfile,docker-compose.yml), and source code as described inreferences/deriving-from-code.md. - Boundary markers: The instructions in
references/notation-and-quality.mdexplicitly require distinguishing between "Observed" evidence and "Inferred" guesses, and advise the agent to consult the user for clarification on ambiguous data. - Capability inventory: The
scripts/render.shscript possesses the capability to execute shell commands and launch Docker containers to process the extracted models. - Sanitization: The skill relies on the agent's internal reasoning and manual human verification to ensure the integrity of the generated diagrams.
Audit Metadata