soia-cwork-processon-diagrams
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data such as ProcessOn folder names, diagram titles, and extracted node text which could contain malicious instructions.
- Ingestion points: Data enters the agent context through the inventory checkpoints (scripts/processon_inventory_state.py) and file inspection (scripts/inspect_processon_export.py).
- Boundary markers: The skill uses a strict three-stage workflow (SKILL.md) and requires the agent to ask the user for confirmation before parsing, converting, or upgrading any artifact.
- Capability inventory: The skill uses Playwright for browser automation, writes state files and archived diagrams to the local filesystem, and executes a suite of internal Python scripts.
- Sanitization: The
inspect_processon_export.pyscript includes aclean_textfunction that strips HTML tags and normalizes whitespace, reducing the risk of markup-based injection payloads. - [COMMAND_EXECUTION]: The skill executes several internal Python scripts (e.g.,
processon_browser_runner.py,processon_inventory_state.py) to manage its workflow. These scripts are part of the skill's distribution and perform well-defined state management and browser automation tasks. - [DATA_EXPOSURE]: The skill explicitly avoids handling user credentials. It requires a manual login in a headed browser window (provided by Playwright) where the user interacts directly with the ProcessOn login page. The skill runner is designed to reject actions involving sensitive keys like 'password' or 'cookie'.
Audit Metadata