archify
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
node:child_processmodule within its central CLI wrapper to execute internal renderer scripts. This behavior is restricted to a hardcoded set of diagram types, ensuring that the skill only runs its own verified modules. - [DYNAMIC_EXECUTION]: The skill generates standalone JSON schema validators using the
ajvlibrary during setup and dynamically imports them for internal health checks. This process is used to provide high-performance, dependency-free validation and is confined to scripts within the skill's own directory. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-supplied descriptions and Mermaid diagrams. It includes defensive measures such as strict schema validation for all diagram components and HTML entity escaping for labels and text, which helps protect against cross-site scripting (XSS) in the generated HTML output.
Audit Metadata