processon-diagram-generator
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs a version check by fetching a JSON file from the vendor's GitHub repository (
github.com/processonai/processon-skills). This is a legitimate maintenance task used to notify the user of updates. - [COMMAND_EXECUTION]: The skill instructs the agent to use
run_shell_commandto executecurlfor the version check. It also provides shell commands for the user to set up environment variables and update the skill. These are standard developer workflows. - [DATA_EXFILTRATION]: The skill handles a sensitive API key (
PROCESSON_API_KEY) provided by the user via environment variables. This key is transmitted only to the official service domain (smart.processon.com) for authentication purposes. No evidence of unauthorized data exfiltration was found. - [PROMPT_INJECTION]: The skill contains instructional language for the agent to optimize user prompts for diagramming, but no patterns were detected that attempt to bypass AI safety filters or override system-level constraints.
Audit Metadata