eraser-diagrams

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the curl command-line tool to transmit generated Eraser DSL to the official rendering API at app.eraser.io. This is the intended and documented method for interacting with the service.
  • [EXTERNAL_DOWNLOADS]: The skill retrieves rendered diagram images and editor URLs from Eraser's official service infrastructure. These external references are legitimate vendor resources necessary for the skill's primary function.
  • [INDIRECT_PROMPT_INJECTION]: The skill analyzes user-provided source code, infrastructure-as-code files (e.g., Terraform, AWS, Azure), and descriptions to extract architectural metadata. This ingestion of untrusted data constitutes an indirect prompt injection surface; however, the skill is constrained to generating visualization DSL and does not execute the processed content directly.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 03:14 PM
Security Audit — agent-trust-hub — eraser-diagrams