ascii-diagram-boxflow
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, prompt injections, or exfiltration vectors were identified in the skill instructions or the Python rendering script.
- [REMOTE_CODE_EXECUTION]: The script
scripts/boxflow.pyuses standard string manipulation and JSON parsing to generate diagrams. It does not employeval(),exec(), or subprocess spawning. - [DATA_EXPOSURE]: The skill does not request or handle sensitive files, environment variables, or hardcoded credentials.
- [EXTERNAL_DOWNLOADS]: The skill relies solely on the local Python interpreter (>=3.8) and does not fetch external packages or remote code at runtime.
- [INDIRECT_PROMPT_INJECTION]: While the skill ingests user-provided node labels, the output is restricted to formatted ASCII text, and the script includes basic sanitization by truncating labels that exceed the specified box width.
Audit Metadata