diagrams-js/rendering-export
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill content provides standard documentation and code snippets for using the diagrams-js library. No malicious instructions, obfuscation, or persistence mechanisms were detected.
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the sharp package for Node.js image processing. sharp is a widely-used and reputable library. The sources listed in the frontmatter point to the author's official GitHub repository.
- [COMMAND_EXECUTION]: The skill demonstrates how to use the local file system (via fs.writeFileSync and diagram.save()) to export diagrams. These operations are consistent with the skill's stated purpose and do not target sensitive system files.
- [INDIRECT_PROMPT_INJECTION]: The skill includes functionality for importing diagram data from SVG and JSON sources. While this establishes a surface for processing potentially untrusted data, it is a standard and expected feature of the library for diagram serialization.
- [DYNAMIC_EXECUTION]: The documentation mentions dynamic loading of provider modules and includes a hook system for SVG post-processing. These are legitimate architectural features of the diagrams-js library and are used here for customization rather than malicious execution.
Audit Metadata