statechart
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the TLA+ TLC model checker (tla2tools.jar) from the official TLA+ GitHub repository and the Java runtime from the Eclipse Temurin distribution via the 'mise' version manager. It also installs 'pele' and '@resvg/resvg-js' from the NPM registry to handle diagram layout and SVG rendering. These are well-known technology sources and the downloads include integrity checks (checksums).
- [COMMAND_EXECUTION]: The tool executes system commands including 'java' to run the model checker and 'npm'/'mise' for automated environment setup. This is required for the skill's primary function of model analysis.
- [DYNAMIC_EXECUTION]: The skill dynamically imports a JavaScript mapping file ('.map.mjs') to interpret model states and steps into user-defined labels. This mapping file is a standard extension point for the tool and is typically generated locally based on the spec being analyzed.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes TLA+ and Mermaid files. While these files define system logic, they represent an attack surface where malicious models could attempt to influence an agent's reasoning about a system's safety or correctness.
Audit Metadata