schemdraw-circuit-generator
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided natural language to generate Python scripts, creating an attack surface where malicious input could influence the agent's code execution. Ingestion points: Natural language circuit descriptions provided during the workflow. Boundary markers: None explicitly mentioned to isolate user input from script logic. Capability inventory: Shell execution of Python and Node.js. Sanitization: The skill relies on the model's ability to safely translate instructions into code without performing explicit input validation.
- [DYNAMIC_EXECUTION]: The skill generates and executes Python scripts (
/tmp/circuit.py) at runtime to render diagrams based on user specifications. - [REMOTE_CODE_EXECUTION]: The skill depends on the external
schemdrawlibrary and references a vendor-ownedheadless-browserskill for visual verification tasks.
Audit Metadata