skills/likas07/t3code-skills/draw-io/Gen Agent Trust Hub

draw-io

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions and local scripts for converting diagrams to images and searching for icons.
  • The shell script scripts/convert-drawio-to-png.sh uses the drawio CLI to export XML to PNG and automatically stages the resulting images in the local Git repository using git add.
  • The Python script scripts/find_aws_icon.py performs local searches within the skill's reference files.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and modify .drawio XML files provided by the user.
  • Ingestion points: The agent reads and parses external XML diagram files.
  • Capability inventory: The skill can execute local scripts, perform file system writes (generating PNGs), and interact with Git commands.
  • Sanitization: Instructions focus on precise manipulation of specific XML tags (mxGeometry, mxCell) and coordinate calculations, which limits the risk of arbitrary command injection through the diagram data.
  • [EXTERNAL_DOWNLOADS]: The documentation references external resources and repositories on GitHub (e.g., jgraph/drawio, m-radzikowski/diagrams-aws-icons) for icon assets and general documentation. These references are informative and point to well-known community resources.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 07:42 PM