miro-code-explain-on-board
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external codebases to generate visual diagrams and documentation, creating a surface for potential injection via malicious code comments or identifiers.\n
- Ingestion points: The workflow involves analyzing repository artifacts, subsystems, and specific code symbols from a user-provided repository as outlined in the analysis and design steps.\n
- Boundary markers: The skill includes instructions to mark ungrounded information as
UNKNOWN/VERIFYand mandates pre-compilation checks, but it lacks explicit data delimiters to isolate untrusted codebase content from the agent's internal instructions.\n - Capability inventory: The skill possesses the ability to create and update Mermaid diagrams on Miro boards using
diagram_create_mermaidanddiagram_update_mermaid, and to generate companion documents viadoc_create.\n - Sanitization: The instructions do not specify a process for sanitizing or escaping content extracted from the codebase before it is incorporated into the generated Mermaid code or document text.
Audit Metadata