workflow-diagram
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The instructions direct the agent to invoke a shell command:
node scripts/figma_cmd.mjs <channel> create_workflow_diagram '<paramsJSON>'. The<paramsJSON>argument is constructed using labels and sublabels sourced directly from user descriptions. If the agent interpolates these strings into the command without escaping single quotes ('), it creates a command injection vulnerability where a user could break out of the JSON string and execute arbitrary shell commands. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection because it processes untrusted user data to drive agent actions.
- Ingestion points: User descriptions are parsed to identify nodes, edges, and labels in the
Workflowsection ofSKILL.md. - Boundary markers: None. There are no instructions for the agent to use delimiters or to disregard instructions embedded within the user-provided workflow description.
- Capability inventory: The agent has the capability to execute shell commands via
node scripts/figma_cmd.mjs. - Sanitization: The skill lacks instructions for sanitizing or escaping the user-provided text before it is inserted into the command payload.
Audit Metadata