skills/rheinmir/skills/diagram/Gen Agent Trust Hub

diagram

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the 'archify' engine from the author's own repository (Rheinmir/archify) using a skill installation command.
  • [COMMAND_EXECUTION]: The skill executes shell commands to perform its core functions:
  • Invokes node to run the archify.mjs script for diagram generation.
  • Runs python3 to execute internal validation tools such as fdk/tools/frontend-antipattern.py and fdk/tools/visual-receipt.py on the generated HTML files.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied descriptions and Mermaid syntax to generate diagrams, which represents a typical injection surface for agent skills. The skill attempts to mitigate risks through:
  • Ingestion points: User prompts and provided Mermaid code.
  • Boundary markers: None explicitly specified for prompt interpolation.
  • Capability inventory: The skill can execute shell commands (node, python3) and write to the local file system.
  • Sanitization: The skill relies on deterministic engines and post-generation validation scripts (frontend-antipattern.py) to detect and reject malformed or non-compliant output, including checks for remote references.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 02:27 AM