writing-skills

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script render-graphs.js utilizes execSync to run the Graphviz dot command for rendering diagrams. This is a standard utility function provided for skill visualization.
  • [DYNAMIC_EXECUTION]: The skill performs dynamic execution by parsing Graphviz code blocks from markdown and piping them to the system's dot binary at runtime via render-graphs.js.
  • [INDIRECT_PROMPT_INJECTION]: A vulnerability surface exists in render-graphs.js where it ingests and processes content from SKILL.md. The script specifically extracts dot blocks and renders them, which is a contained ingestion pattern consistent with the skill's purpose.
  • [EXTERNAL_DOWNLOADS]: The documentation file anthropic-best-practices.md includes references to image assets hosted on a well-known content delivery network associated with official documentation services.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 03:43 PM