writing-claude-skills
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
render-graphs.jsexecutes the systemdotcommand (Graphviz) viachild_process.execSyncto convert Mermaid/Dot diagrams in documentation into SVG images. This is a local utility function used for documentation rendering. - [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for processing external data (e.g., CSV files in
csv-data-analyzer-example.md). While this creates a potential surface for indirect injection from untrusted files, the skill explicitly includes a<validation>phase and instructions for sanitizing data types and formats to mitigate such risks. - [PROMPT_INJECTION]: The documentation (
persuasion-principles.md) utilizes strong imperative language and psychological framing (e.g., "YOU MUST", "No exceptions", "Delete means delete") to ensure AI agents follow strict technical workflows like TDD. These instructions are intended to enforce technical discipline rather than bypass safety filters or ignore system-level constraints.
Audit Metadata