plan-dag

Pass

Audited by Gen Agent Trust Hub on May 17, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill processes data from GitHub issues to create visual dependency graphs. It includes a dedicated validation layer in plan-dag-render.py that checks for forbidden characters and structural integrity of the input data before rendering.
  • [COMMAND_EXECUTION]: The skill invokes the dot utility from the Graphviz suite and the node runtime for rendering. These calls are made using subprocess.run with list-based arguments, which prevents shell injection by avoiding the use of a shell for execution.
  • [EXTERNAL_DOWNLOADS]: The skill relies on standard tools like graphviz and playwright. These are well-known, reputable software packages commonly used for diagramming and browser automation. The installation instructions provided for the user follow best practices.
  • [PROMPT_INJECTION]: No malicious prompt injection patterns were detected in the instructions or metadata. The skill instructions focus strictly on its stated purpose of assisting with project planning and visualization.
Audit Metadata
Risk Level
SAFE
Analyzed
May 17, 2026, 01:57 PM
Security Audit — agent-trust-hub — plan-dag