technical-drawing
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is designed to generate technical drawings (SVG, PNG, PDF) and build a self-contained offline viewer. It explicitly instructs the agent to treat external documents and images as evidence rather than instructions, providing a guardrail against indirect prompt injection.
- [COMMAND_EXECUTION]: The skill includes several Node.js utility scripts (
build-viewer.cjsand varioustest-*.cjsfiles) for packaging and verifying the drawing viewer. These are used locally by the developer/agent and do not involve untrusted network operations. - [DYNAMIC_EXECUTION]: Test scripts (
test-viewer-builder.cjs,test-render-queue.cjs,test-theme.cjs) utilize the Node.jsvmmodule to execute and verify the integrity of the generated frontend scripts in a controlled environment. - [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data in the form of reference images and documents. However, it contains explicit instructions to ignore any embedded commands and focus only on geometric evidence, effectively mitigating the risk.
Audit Metadata