illustrate
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from conversations and source files to create visualizations. This creates an attack surface where malicious instructions embedded in the processed data could potentially influence the agent's output or actions.
- Ingestion points: User conversation and workspace source code (processed via instructions in SKILL.md and HTML.md).
- Boundary markers: The instructions lack explicit delimiters or warnings to ignore commands embedded within the data being visualized.
- Capability inventory: The agent has the ability to write files to the workspace and execute shell commands (open, xdg-open) via the instructions in HTML.md.
- Sanitization: There are no instructions for sanitizing or escaping the data before it is included in the generated diagrams or HTML artifacts.
- [DYNAMIC_EXECUTION]: The skill generates HTML files dynamically, which may include styles and scripts for visualization, and subsequently opens them using system tools.
- Evidence: HTML.md instructs the agent to create illustrate-{topic}.html files including necessary scripts and to use system openers to display the result.
- [COMMAND_EXECUTION]: The instructions explicitly direct the agent to use shell commands to facilitate the visualization workflow.
- Evidence: HTML.md specifies using open on macOS or xdg-open on Linux to render the generated artifacts.
Audit Metadata