diagram-maker
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to generate and save files to the local file system, specifically './diagram.html' and './diagram.excalidraw'.
- [SAFE]: The instructions explicitly prohibit the inclusion of JavaScript, external fonts, remote images, or other external assets in the generated HTML/SVG output, which effectively mitigates common attack vectors like Cross-Site Scripting (XSS) in generated artifacts.
- [DATA_EXPOSURE]: The skill's metadata contains a hardcoded local file path in a migration note ('/var/folders/27/xyyzc_n172l3jjmnxgqmhhzh0000gn/T/...'). While this reveals information about the environment where the skill was developed or stored, it is not used for runtime operations or data exfiltration.
Audit Metadata