external-diagram-mermaid-generate

Pass

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/query-org-metadata.py executes Salesforce CLI (sf) commands using subprocess.run. This is a legitimate functional requirement to retrieve organizational data such as record counts and sharing settings to ground the generated diagrams.\n- [COMMAND_EXECUTION]: The scripts/mermaid_preview.py utility uses subprocess.Popen to manage its own background process for a local HTTP preview server. This is used strictly to provide the documented live-reload functionality in the browser.\n- [EXTERNAL_DOWNLOADS]: The preview server's HTML template includes a reference to the Mermaid.js library hosted on a reputable and well-known CDN (jsDelivr). This is a standard practice for client-side rendering tools and does not involve downloading untrusted executable code.\n- [SAFE]: The skill follows security best practices by using placeholders for sensitive configuration, providing ASCII fallbacks for accessibility, and implementing JavaScript escaping in the preview server to prevent cross-site scripting.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 7, 2026, 01:01 PM
Security Audit — agent-trust-hub — external-diagram-mermaid-generate