lucidchart-performance-tuning
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill demonstrates safe credential management by referencing environment variables (
LUCID_ACCESS_TOKEN,REDIS_URL) instead of hardcoding secrets. - [EXTERNAL_DOWNLOADS]: The implementation interacts with the official Lucidchart API (
api.lucid.co). As this is a well-known and expected service for the skill's purpose, the network activity is considered safe. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a potential attack surface for indirect prompt injection as it ingests document and shape data from an external API.
- Ingestion points: Data is fetched from the Lucidchart API via
lucidApi.getDocumentandlucidApi.getShapesinSKILL.mdand then processed by the agent. - Boundary markers: None; the implementation handles data as structured JSON objects for caching and batching.
- Capability inventory: The skill has access to network operations (
fetch) and file system tools (Read,Write,Edit). - Sanitization: None; the provided code focus is on performance architecture (caching and rate limiting) and does not include content validation or filtering for ingested diagram data.
Audit Metadata