Skills
Navigate
skills/rkiding/awesome-finance-skills/alphaear-logic-visualizer/Gen Agent Trust Hub

alphaear-logic-visualizer

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted logic descriptions to generate XML and charts.
  • Ingestion points: The nodes_json variable in references/PROMPTS.md and nodes_data in scripts/visualizer_prompt.py are interpolated directly into prompts.
  • Boundary markers: No delimiters or ignore instructions are used to wrap the untrusted data.
  • Capability inventory: The scripts/visualizer.py script contains capabilities to write to the local filesystem via render_drawio_to_html and render_chart_to_file.
  • Sanitization: The render_drawio_to_html function uses html.escape and json.dumps to safely embed the generated XML into the HTML output, which prevents potential cross-site scripting (XSS) risks in the viewer.
  • [EXTERNAL_DOWNLOADS]: The render_drawio_to_html method in scripts/visualizer.py generates HTML files that reference a JavaScript library from https://viewer.diagrams.net/js/viewer-static.min.js. This is a well-known service provided by diagrams.net for rendering Draw.io compatible diagrams.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 05:40 AM