mindmap
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill requires running a local Python script (geometry-audit.py) via the command line to validate generated mindmap HTML files. This script is located in a sibling resource folder and relies on path resolution via the ${CLAUDE_PLUGIN_ROOT} environment variable.\n- [EXTERNAL_DOWNLOADS]: The mindmap HTML output references external typography from a well-known service (Google Fonts).\n- [PROMPT_INJECTION]: The skill processes untrusted user-provided prose to extract diagram structure, creating a surface for indirect prompt injection.\n
- Ingestion points: User-provided mindmap briefs in SKILL.md.\n
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore' warnings for user input.\n
- Capability inventory: The skill has the ability to write local HTML files and execute an external Python script.\n
- Sanitization: No explicit sanitization or structural validation of the extracted labels is provided.
Audit Metadata