hand-drawn-diagrams
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions and shell scripts to download and install its full functionality from a third-party GitHub repository (
muthuishere/hand-drawn-diagrams) using thenpx skills addcommand. - [DATA_EXFILTRATION]: Generated diagrams are shared via hosted links where the diagram's content is encoded directly into the URL. This data is transmitted to the author's external GitHub Pages site (
muthuishere.github.io) when the links are accessed. - [COMMAND_EXECUTION]: The skill's installation logic executes shell commands to check for existing files and runs
npxto fetch external packages. It also specifies that it executes local Python scripts using theuvtool. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted text prompts from users to generate visual diagrams. This ingestion point lacks explicit boundary markers or sanitization documentation, creating a surface where malicious instructions embedded in a prompt could attempt to influence the agent's behavior during the diagram generation process.
Audit Metadata