ccf-visual-composer
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a bundled Python library (
ccfa_plot_recipes.py) designed to generate editable SVG plots using only standard library modules. The instructions direct the agent to adapt these recipes for specific data visualization tasks, which is a standard and well-controlled use of the execution environment for scientific deliverables. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied manuscripts, architectural notes, and data to generate specifications and prompts for image generation tools.
- Ingestion points: Technical content and architectural descriptions are extracted from the user's project files as described in
references/architecture-diagram-generation.md. - Boundary markers: The skill uses a 'Visual Contract' (
references/visual-contract.md) and a 'Diagram Specification' to structure and delimit external data. - Capability inventory: The skill utilizes Python execution for plotting and the host's image generation capability (GPT Image 2).
- Sanitization: The skill mitigates the risk of processing malicious data by requiring a 'Required GPT Image 2 Confirmation Gate,' where the agent must display the derived prompt and obtain explicit user authorization before invoking the external generation tool.
Audit Metadata