diagram
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the 'archify' engine from the author's own repository (Rheinmir/archify) using a skill installation command.
- [COMMAND_EXECUTION]: The skill executes shell commands to perform its core functions:
- Invokes
nodeto run thearchify.mjsscript for diagram generation. - Runs
python3to execute internal validation tools such asfdk/tools/frontend-antipattern.pyandfdk/tools/visual-receipt.pyon the generated HTML files. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied descriptions and Mermaid syntax to generate diagrams, which represents a typical injection surface for agent skills. The skill attempts to mitigate risks through:
- Ingestion points: User prompts and provided Mermaid code.
- Boundary markers: None explicitly specified for prompt interpolation.
- Capability inventory: The skill can execute shell commands (
node,python3) and write to the local file system. - Sanitization: The skill relies on deterministic engines and post-generation validation scripts (
frontend-antipattern.py) to detect and reject malformed or non-compliant output, including checks for remote references.
Audit Metadata