architecture-diagram
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches typography from a well-known service.
- Evidence: Loads 'JetBrains Mono' font from Google Fonts (fonts.googleapis.com) in the HTML template (templates/template.html).
- [COMMAND_EXECUTION]: The skill provides instructions for the user to execute shell commands to preview the generated diagrams.
- Evidence: Recommends using
openon macOS andxdg-openon Linux to view the resulting HTML file (SKILL.md). - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied architecture descriptions to populate text labels within the generated SVG and HTML code, which is a potential surface for injection.
- Ingestion points: User descriptions of components, connections, and technologies (SKILL.md).
- Boundary markers: Absent; user strings are interpolated directly into the template.
- Capability inventory: Uses
write_fileto save the output locally (SKILL.md). - Sanitization: Absent; the skill does not explicitly instruct the agent to escape or sanitize user input before inclusion in the HTML structure.
Audit Metadata