eraser-diagrams
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
curlcommand-line tool to transmit generated Eraser DSL to the official rendering API atapp.eraser.io. This is the intended and documented method for interacting with the service. - [EXTERNAL_DOWNLOADS]: The skill retrieves rendered diagram images and editor URLs from Eraser's official service infrastructure. These external references are legitimate vendor resources necessary for the skill's primary function.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes user-provided source code, infrastructure-as-code files (e.g., Terraform, AWS, Azure), and descriptions to extract architectural metadata. This ingestion of untrusted data constitutes an indirect prompt injection surface; however, the skill is constrained to generating visualization DSL and does not execute the processed content directly.
Audit Metadata