writing-skills
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
render-graphs.jsutilizesexecSyncto run the Graphvizdotcommand for rendering diagrams. This is a standard utility function provided for skill visualization. - [DYNAMIC_EXECUTION]: The skill performs dynamic execution by parsing Graphviz code blocks from markdown and piping them to the system's
dotbinary at runtime viarender-graphs.js. - [INDIRECT_PROMPT_INJECTION]: A vulnerability surface exists in
render-graphs.jswhere it ingests and processes content fromSKILL.md. The script specifically extractsdotblocks and renders them, which is a contained ingestion pattern consistent with the skill's purpose. - [EXTERNAL_DOWNLOADS]: The documentation file
anthropic-best-practices.mdincludes references to image assets hosted on a well-known content delivery network associated with official documentation services.
Audit Metadata