package-diagram

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill employs bundled shell scripts (scripts/new-canvas and scripts/tq) to perform legitimate operations such as creating canvas files from a template and sending commands to the local tldraw application. These scripts use standard tools like curl, mkdir, and cp.
  • [DYNAMIC_EXECUTION]: To render diagrams, the skill generates JavaScript code that is executed within the tldraw application's environment via a local API. This behavior is the primary method for the skill to interact with the canvas and is guided by detailed templates in the documentation.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data, such as code repository structures or user-provided descriptions, to build diagrams. While this is an ingestion surface for potentially untrusted data, the processing is restricted to generating visual diagram elements within a local application.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 04:13 PM