markmap-analogy-mindmap
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/validate_and_render.pyexecutes shell commands viasubprocess.runto render mind maps. It checks for the availability ofmarkmap,npx, or a localnodeinstallation. These calls use list-based arguments withoutshell=True, which is a secure implementation that prevents command injection. - [EXTERNAL_DOWNLOADS]: The rendering process may invoke
npx --yes markmap-cli, which downloads the necessary rendering tool from the official NPM registry. This is a standard operation for Node.js-based tools and targets a well-known, trusted service. The script further attempts to mitigate unnecessary network activity by using the--offlineflag and disabling browser downloads for its rendering engine.
Audit Metadata