baoyu-diagram
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled script (
scripts/main.ts) using the Bun runtime to convert generated SVG diagrams into high-resolution PNG images. This is a local execution of code distributed with the skill for the primary purpose of image processing. - [EXTERNAL_DOWNLOADS]: The skill references typography assets from Google Fonts (
fonts.googleapis.com), which is a well-known and trusted service for web resources. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and visualize user-provided content or file data.
- Ingestion points: Data enters the system via user prompts or uploaded content processed for diagram generation.
- Boundary markers: The skill uses specific SVG structural guidelines and templates, though explicit boundary markers for user-provided labels within the SVG are not defined.
- Capability inventory: The associated script
main.tshas the capability to read files from the filesystem and write the converted PNG output to a user-specified or default directory. - Sanitization: The image conversion process relies on the
sharplibrary, which provides robust rendering and handles the SVG source as an image asset rather than executable code.
Audit Metadata