blueprint
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's HTML template (
assets/template.html) fetches the Mermaid.js library from the jsDelivr CDN (cdn.jsdelivr.net). This is a well-known and standard service for delivering public web assets. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes repository code, manifests, and configurations to generate architecture diagrams. This process creates a potential attack surface for indirect prompt injection if malicious instructions are embedded in the analyzed code. However, the risk is mitigated by the skill's output format (static Markdown/HTML) and the explicit implementation of Mermaid's
securityLevel: 'strict'configuration to prevent script execution from diagram data. - [COMMAND_EXECUTION]: The skill includes a utility script
scripts/validate-mermaidfor performing static syntax checks on Mermaid diagram sources. This script uses standard Python libraries, operates in a read-only manner, and is used for local linting during the documentation process.
Audit Metadata