writing-skills
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
render-graphs.jsutility script usesexecSyncto run system commands (dot,which) to render Graphviz diagrams from markdown files. - [DYNAMIC_EXECUTION]: The skill includes a Node.js utility script (
render-graphs.js) shipped as part of the skill to process and render visual artifacts. - [PROMPT_INJECTION]: The
persuasion-principles.mdandtesting-skills-with-subagents.mdfiles provide advanced instructions on using behavioral pressure (e.g., 'Authority', 'Scarcity') to ensure agent compliance with documentation rules. - [INDIRECT_PROMPT_INJECTION]: The skill contains an attack surface where
render-graphs.jsingests data fromSKILL.md. 1. Ingestion Point:render-graphs.jsreadingSKILL.md. 2. Boundary Markers: Regex markers fordotblocks. 3. Capability Inventory:execSyncfor shell command execution. 4. Sanitization: Content is passed to the binary viastdin. - [EXTERNAL_DOWNLOADS]: Documentation references official Python packages like
pdfplumberandpypdffor example use cases.
Audit Metadata