technical-drawing

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill is designed to generate technical drawings (SVG, PNG, PDF) and build a self-contained offline viewer. It explicitly instructs the agent to treat external documents and images as evidence rather than instructions, providing a guardrail against indirect prompt injection.
  • [COMMAND_EXECUTION]: The skill includes several Node.js utility scripts (build-viewer.cjs and various test-*.cjs files) for packaging and verifying the drawing viewer. These are used locally by the developer/agent and do not involve untrusted network operations.
  • [DYNAMIC_EXECUTION]: Test scripts (test-viewer-builder.cjs, test-render-queue.cjs, test-theme.cjs) utilize the Node.js vm module to execute and verify the integrity of the generated frontend scripts in a controlled environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data in the form of reference images and documents. However, it contains explicit instructions to ignore any embedded commands and focus only on geometric evidence, effectively mitigating the risk.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 11:52 PM