creating-visual-notes
Pass
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted text input to generate visual diagrams, creating a surface for indirect prompt injection.
- Ingestion points: The script
scripts/generate-mindmap.jsreads text data from input files provided as command-line arguments. - Boundary markers: No delimiters or 'ignore instructions' warnings are present in the script or usage instructions.
- Capability inventory: The script
scripts/generate-mindmap.jsperforms file read and write operations (fs.readFileSync,fs.writeFileSync). - Sanitization: The script performs minimal character escaping (removing quotes and brackets) for Mermaid syntax compatibility but does not sanitize the input for potential agent instructions.
- [COMMAND_EXECUTION]: The skill includes instructions to execute Node.js scripts that perform file system operations (read and write) based on user-supplied file paths, which the agent could be directed to use on sensitive locations.
- [NO_CODE]: The
SKILL.mddocumentation references several scripts (scripts/create-timeline.js,scripts/build-comparison-table.js) and resource files (e.g.,resources/visual-note-patterns.md) that are not included in the provided skill package.
Audit Metadata