draw-io
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied .drawio XML files to perform layout adjustments and coordinate calculations. These files represent an untrusted input surface where malicious instructions could be embedded to influence agent behavior. \n
- Ingestion points: The agent reads and parses .drawio XML files from the local workspace as part of its core functionality. \n
- Boundary markers: The skill instructions lack explicit delimiters or warnings to ignore instructions found within processed files. \n
- Capability inventory: The skill executes a bash script for PNG conversion and git operations, and a Python script for icon lookup. \n
- Sanitization: No input validation or content filtering is performed on the XML values before they are processed or used in shell commands. \n- [COMMAND_EXECUTION]: The skill automates tasks using local shell scripts that invoke external binaries. \n
- The scripts/convert-drawio-to-png.sh script executes the drawio CLI and git add command. \n
- Instructions direct the agent to use mise and pre-commit for workflow automation, involving execution of local repository hooks.
Audit Metadata