statechart
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads external development tools and libraries required for its operation. Specifically, it uses the 'mise' tool manager to download the TLA+ toolset from its official GitHub repository (tlaplus/tlaplus) and the Eclipse Temurin Java distribution. It also uses 'npm' to install the 'pele' and '@resvg/resvg-js' packages for layout and SVG-to-PNG rendering. These sources are well-known and trusted technology providers.
- [COMMAND_EXECUTION]: The skill executes several shell commands as part of its normal workflow. This includes running 'npm' for package management, 'java' to execute the TLA+ checker (TLC), and 'mise' to manage tool versions. It also executes 'fc-match' on Linux systems to resolve system fonts for chart rendering. These operations are restricted to the local environment and the project's scratch folder.
- [DYNAMIC_EXECUTION]: The skill utilizes dynamic JavaScript execution to provide extensibility. It generates a temporary entry script to load the renderer libraries and uses the 'import()' function to load local mapping files (e.g., 'SPEC.map.mjs') provided by the user. These mapping files allow for custom labeling of statechart nodes and edges based on TLA+ variables, which is a core feature of the tool.
Audit Metadata