flow-diagram
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to fetch technology logos from simpleicons.org, which is a well-known public repository for brand icons.
- [COMMAND_EXECUTION]: The workflow involves running local Node.js utility scripts provided in the skill assets (such as check-svg.js and fix-arrow-gaps.js) to automate collision detection and SVG coordinate adjustments. These scripts operate on files locally generated by the agent.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-defined flow data to generate text labels and card descriptions in the final HTML output. Evidence Chain: (1) Ingestion Point: User-supplied flow definitions gathered in SKILL.md Process Step 1. (2) Boundary Markers: Absent. (3) Capability Inventory: The generated HTML includes interactive JavaScript; local Node.js assets use file system modules for processing. (4) Sanitization: The agent follows a structured template, but explicit sanitization of user-provided labels is not detailed.
- [DYNAMIC_EXECUTION]: The skill employs Node.js scripts to programmatically modify the generated HTML content, appending interaction logic and animating SVG elements based on real-time length calculations.
Audit Metadata