visual-explainer

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill clones its core runtime environment from the author's official GitHub repository at https://github.com/theclaymethod/artifacture. It also references well-known CDN services (jsDelivr, Google Fonts) to include libraries like Mermaid.js, Chart.js, and Prism.js in the generated HTML artifacts.
  • [COMMAND_EXECUTION]: The skill executes standard system commands for codebase analysis (git, gh) and media processing (ffmpeg, npm, node). These actions are directly tied to its primary functionality of documenting software projects and rendering visual media.
  • [REMOTE_CODE_EXECUTION]: The verification suite uses Playwright to run a headless browser. A strict network policy is implemented in scripts/network-policy.mjs to ensure the browser only connects to allowed origins (e.g., Google Fonts, jsDelivr) and local resources.
  • [NO_CODE]: The skill provides a local preview server (scripts/preview.mjs) to allow users to annotate and edit artifacts. This server includes a safeResolve function to prevent path traversal attacks by ensuring requested assets do not escape the artifact's root directory.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 07:25 PM
Security Audit — agent-trust-hub — visual-explainer