writing-skills

Pass

Audited by Gen Agent Trust Hub on Jul 29, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The render-graphs.js script uses child_process.execSync to invoke the dot utility. This is a standard developer tool used to render Graphviz diagrams into SVG format. The script passes diagram content from SKILL.md to the dot process via standard input, which is a common and legitimate use of shell execution in this context.
  • [PROMPT_INJECTION]: The skill uses "pressure scenarios" and "persuasion principles" (documented in persuasion-principles.md and testing-skills-with-subagents.md) to ensure agent compliance with documentation rules. These involve authoritative language such as "IMPORTANT: This is a real scenario" or "YOU MUST." These patterns mimic injection techniques but are used here as a methodology to improve the reliability and safety of agent behavior.
  • [EXTERNAL_DOWNLOADS]: The skill references official documentation from Anthropic and research papers from the University of Pennsylvania. These are trusted technical and academic sources. The render-graphs.js script also provides instructions for installing the graphviz package via official package managers (brew and apt).
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 29, 2026, 10:40 AM
Security Audit — agent-trust-hub — writing-skills