blueprint-figure
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external system data, such as logs and source code, to generate diagram labels. \n
- Ingestion points: The skill instructions explicitly direct the agent to collect data from running records, logs, specifications, and source code. \n
- Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore potentially malicious instructions embedded in the ingested data. \n
- Capability inventory: The utility script
templates/figure.mjshas the capability to write to the local file system using the Node.jsnode:fsmodule. \n - Sanitization: The script includes an
escfunction that sanitizes labels by replacing special characters (&, <, >, ") before they are embedded in the SVG output, mitigating SVG injection risks. \n- [DYNAMIC_EXECUTION]: The skill uses a Node.js script to dynamically generate SVG files based on provided data. \n - The script
templates/figure.mjswrites the generated content to a file path provided via command-line arguments. This is standard behavior for a build or documentation tool.
Audit Metadata