visualize-changes

Warn

Audited by Gen Agent Trust Hub on Mar 20, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/render-md.ts script (and its bundled version bin/glimpse-changes.js) implements a custom Markdown parser that identifies shell commands wrapped in the syntax ! \command`and executes them usingchild_process.execSync. The renderCommandDiff` function directly passes the string extracted from the Markdown to the shell without sanitization, allowing for arbitrary command execution.
  • [EXTERNAL_DOWNLOADS]: The generated HTML document includes a boot script that dynamically imports the @pierre/diffs library from https://esm.sh/@pierre/diffs@1.1.1?bundle and https://esm.sh/@pierre/diffs@1.1.1/ssr?bundle at runtime. These are well-known external sources used for the skill's intended diff visualization functionality.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 20, 2026, 03:03 AM