visualize-changes
Warn
Audited by Gen Agent Trust Hub on Mar 20, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/render-md.tsscript (and its bundled versionbin/glimpse-changes.js) implements a custom Markdown parser that identifies shell commands wrapped in the syntax! \command`and executes them usingchild_process.execSync. TherenderCommandDiff` function directly passes the string extracted from the Markdown to the shell without sanitization, allowing for arbitrary command execution. - [EXTERNAL_DOWNLOADS]: The generated HTML document includes a boot script that dynamically imports the
@pierre/diffslibrary fromhttps://esm.sh/@pierre/diffs@1.1.1?bundleandhttps://esm.sh/@pierre/diffs@1.1.1/ssr?bundleat runtime. These are well-known external sources used for the skill's intended diff visualization functionality.
Audit Metadata