skills/connorads/dotfiles/c4-diagrams/Gen Agent Trust Hub

c4-diagrams

Pass

Audited by Gen Agent Trust Hub on Jul 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/render.sh utility script is designed to fetch diagram rendering tools from well-known, reputable sources if they are not already installed. It uses pnpm dlx to run the Mermaid CLI from the npm registry and docker run to execute the PlantUML and Structurizr CLI images from Docker Hub.
  • [COMMAND_EXECUTION]: The skill includes a helper shell script (scripts/render.sh) that automates the transformation of text-based diagram definitions into visual images. This script is intended to be used locally by the agent or developer as part of the documentation process.
  • [PROMPT_INJECTION]: The skill instructs the agent to analyze external repository content (such as project manifests, source code, and READMEs) to derive architecture models, which creates an indirect prompt injection surface.
  • Ingestion points: Evaluates project files including package.json, pom.xml, Dockerfile, and .env for system discovery.
  • Boundary markers: Not explicitly defined, though the skill mandates labeling data as "Observed" vs "Inferred" to maintain accuracy.
  • Capability inventory: Local execution of the render.sh script and read access to the workspace.
  • Sanitization: Relies on the agent's reasoning; no automated sanitization is performed on the raw data ingested during the discovery process.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 18, 2026, 03:45 PM
Security Audit — agent-trust-hub — c4-diagrams