drawio-skill
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local binaries including
drawio,dot(Graphviz),tred(Graphviz), andxvfb-run. These tools are used to render diagrams from XML, calculate automatic layouts via Graphviz clusters, and perform transitive reduction on import graphs. These executions are documented in the prerequisites and are necessary for the skill's operation. - [EXTERNAL_DOWNLOADS]: The
scripts/aiicons.pyutility fetches SVG brand logos from public CDNs includingunpkg.comandcdn.simpleicons.org. These requests are used to provide up-to-date iconography for AI services and databases. These sources are well-known and the downloads are limited to static assets. - [COMMAND_EXECUTION]: The skill includes instructional code blocks suggesting system-level installations (e.g.,
brew install,apt install). These are intended for user-guided setup of prerequisites and are not executed autonomously by the skill. - [DATA_EXPOSURE]: The provided importer scripts (e.g.,
pyimports.py,jsimports.py,rustimports.py) read local source code directories to extract project structure metadata. This process uses static analysis to generate import and class hierarchy graphs for visualization, which is the primary function of the skill.
Audit Metadata