engineer-design-diagram

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONDYNAMIC_EXECUTION
Full Analysis
  • [DYNAMIC_CONTEXT_INJECTION]: The skill uses platform-native dynamic context injection (!) in the SKILL.md file to gather metadata about the local environment. This includes checking for git status, manifest existence (package.json, pyproject.toml), and infrastructure tools (Docker, Kubernetes, Terraform) to ground the AI's understanding of the repository topology.
  • [EXTERNAL_DOWNLOADS]: The generated HTML templates include references to external resources from well-known services. Specifically, it loads typography from Google Fonts and the Mermaid.js library from the JSDelivr CDN for rendering diagrams that exceed the manual SVG layout limits. These references are documented and restricted by the skill's own validation logic.
  • [COMMAND_EXECUTION]: The skill utilizes local CLI tools such as git, docker, kubectl, and terraform to introspect the project structure. These operations are performed via a bounded shell script (scripts/collect_dci.sh) that enforces output size caps to prevent resource exhaustion and ensure the data stays within the agent's context limits.
  • [DATA_EXPOSURE]: The skill accesses local configuration files, including Terraform state and Kubernetes manifests, to infer component relationships. While these files may contain architectural metadata, the skill operates entirely within the local environment and does not contain instructions or code to exfiltrate this data to external servers.
  • [DYNAMIC_EXECUTION]: Architecture diagrams are generated dynamically by filling HTML/SVG templates. To mitigate risks associated with dynamic content generation, the skill includes a dedicated validator (scripts/validate_html.py) that checks the resulting files for accessibility compliance and ensures no unauthorized external scripts are injected into the final output.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 09:31 AM