external-diagram-mermaid-generate
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/query-org-metadata.pyexecutes Salesforce CLI (sf) commands usingsubprocess.run. This is a legitimate functional requirement to retrieve organizational data such as record counts and sharing settings to ground the generated diagrams.\n- [COMMAND_EXECUTION]: Thescripts/mermaid_preview.pyutility usessubprocess.Popento manage its own background process for a local HTTP preview server. This is used strictly to provide the documented live-reload functionality in the browser.\n- [EXTERNAL_DOWNLOADS]: The preview server's HTML template includes a reference to the Mermaid.js library hosted on a reputable and well-known CDN (jsDelivr). This is a standard practice for client-side rendering tools and does not involve downloading untrusted executable code.\n- [SAFE]: The skill follows security best practices by using placeholders for sensitive configuration, providing ASCII fallbacks for accessibility, and implementing JavaScript escaping in the preview server to prevent cross-site scripting.
Audit Metadata