package-diagram
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill employs bundled shell scripts (
scripts/new-canvasandscripts/tq) to perform legitimate operations such as creating canvas files from a template and sending commands to the local tldraw application. These scripts use standard tools likecurl,mkdir, andcp. - [DYNAMIC_EXECUTION]: To render diagrams, the skill generates JavaScript code that is executed within the tldraw application's environment via a local API. This behavior is the primary method for the skill to interact with the canvas and is guided by detailed templates in the documentation.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data, such as code repository structures or user-provided descriptions, to build diagrams. While this is an ingestion surface for potentially untrusted data, the processing is restricted to generating visual diagram elements within a local application.
Audit Metadata