visualise-blast-area
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill optionally utilizes the
dependency-cruiserandwatskeburtCLI tools if they are already present in the user's environment to increase mapping precision for JavaScript/TypeScript projects. It explicitly instructs the agent not to install these dependencies if they are missing, preventing unauthorized environment modifications. - [DATA_EXFILTRATION]: The skill implements a 'Smart HTML contract' for its interactive output, which strictly forbids all external network requests, including CDNs, fonts, or tracking scripts. This ensures the generated report remains private and functional in offline or restricted environments, preventing data leakage through external resource loading.
- [DATA_EXFILTRATION]: The 'Run Record' convention included in the skill enforces the exclusion of secret values, credentials, and machine-absolute paths from any documentation written to the repository, minimizing the risk of accidental information disclosure during the reporting process.
- [INDIRECT_PROMPT_INJECTION]: The skill consumes structured JSON envelopes produced by other tools. It mitigates injection risks by performing structural validation before rendering and by mapping incoming data to a restricted, hardcoded vocabulary of states and confidence levels rather than executing data-driven commands.
Audit Metadata