drawio-bpmn
Warn
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
drawio-ai-kitfrom an external GitHub repository (github:sparklabx/drawio-ai-kit). This source is not recognized as a trusted organization or well-known service. - [DYNAMIC_EXECUTION]: The skill's primary workflow involves a 'scaffolding' step where a JavaScript file (
build.mjs) is generated and then executed using thenoderuntime. This creates a risk of dynamic code execution based on logic provided by the external toolkit. - [COMMAND_EXECUTION]: The skill uses a custom CLI tool (
drawio-ai) to perform various operations, including resolving absolute paths on the file system (drawio-ai root) and rendering images. The instructions explicitly direct the agent to run these shell commands to manage the diagram build loop.
Audit Metadata