diagram
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied labels and edge data which are then embedded into a generated HTML template. This represents a potential surface for injection if the input contains malicious HTML or script tags, but it is necessary for the skill's visualization purpose.
- Ingestion points: User requests and context strings from the conversation.
- Boundary markers: None explicitly present for user-supplied text in the JavaScript element objects.
- Capability inventory: Writing local files, browser navigation, and script evaluation via the Chrome DevTools MCP.
- Sanitization: No explicit validation or escaping of user labels is required by the workflow.
- [EXTERNAL_DOWNLOADS]: Fetches the Cytoscape.js library from Cloudflare's public CDN. This is a well-known service and is a safe, standard dependency for this type of tool.
- [DYNAMIC_EXECUTION]: The skill generates HTML and JavaScript at runtime to be executed within a browser context for diagram rendering. This is the primary function of the skill and uses a static, well-known library.
Audit Metadata