skills/mastra-ai/mastra/docs-diagrams/Gen Agent Trust Hub

docs-diagrams

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute several shell commands within the project environment.
  • grep -rn "<image-filename>" docs/src: Used to locate image references.
  • cd docs && pnpm dev --port 3005: Runs a local development server for visual verification.
  • pnpm lint:remark: Runs documentation linting.
  • pnpm build: Executes a full build of the documentation site.
  • [INDIRECT_PROMPT_INJECTION]: The grep command template grep -rn "<image-filename>" docs/src introduces a surface for command injection if the agent blindly interpolates user-provided text into the shell command.
  • Ingestion points: User-provided image filenames for conversion triggers (e.g., "convert diagram image_name.png").
  • Boundary markers: None provided in the command template to prevent shell meta-character execution.
  • Capability inventory: The skill uses shell access for file searching, running a dev server, and triggering builds.
  • Sanitization: The instructions do not include validation or sanitization steps for the <image-filename> variable before execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 10:09 PM
Security Audit — agent-trust-hub — docs-diagrams