screen-flow-diagram
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input to generate the 'flowData' structure in the output HTML. Without sanitization, malicious strings provided by a user could be executed as scripts when the resulting file is opened in a browser. Ingestion points: User-provided descriptions of screens, actions, and navigation logic. Boundary markers: None specified in the instructions for the agent. Capability inventory: File system write access to create .html files. Sanitization: The skill lacks instructions for the agent to sanitize or escape user-provided content before interpolation.
- [EXTERNAL_DOWNLOADS]: The generated diagrams reference the D3.js library from the jsDelivr CDN. This is a well-known service and the reference is necessary for the intended functionality.
- [DYNAMIC_EXECUTION]: The skill functions as a code generator, creating a standalone HTML/JavaScript application from templates and user-supplied data. This is consistent with its stated purpose of building interactive diagrams.
Audit Metadata