visual-explainer
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill clones its core runtime environment from the author's official GitHub repository at
https://github.com/theclaymethod/artifacture. It also references well-known CDN services (jsDelivr, Google Fonts) to include libraries like Mermaid.js, Chart.js, and Prism.js in the generated HTML artifacts. - [COMMAND_EXECUTION]: The skill executes standard system commands for codebase analysis (
git,gh) and media processing (ffmpeg,npm,node). These actions are directly tied to its primary functionality of documenting software projects and rendering visual media. - [REMOTE_CODE_EXECUTION]: The verification suite uses Playwright to run a headless browser. A strict network policy is implemented in
scripts/network-policy.mjsto ensure the browser only connects to allowed origins (e.g., Google Fonts, jsDelivr) and local resources. - [NO_CODE]: The skill provides a local preview server (
scripts/preview.mjs) to allow users to annotate and edit artifacts. This server includes asafeResolvefunction to prevent path traversal attacks by ensuring requested assets do not escape the artifact's root directory.
Audit Metadata