dynamic-archify
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill and its outputs reference external assets from trusted and standard providers.\n
- Fetches typography from Google Fonts (fonts.googleapis.com) during diagram generation.\n
- Generated HTML files load the gif.js library from the jsDelivr CDN (cdn.jsdelivr.net) to provide animation export functionality.\n- [PROMPT_INJECTION]: The skill handles untrusted JSON data, creating a potential surface for indirect prompt injection.\n
- Ingestion points: Node.js renderers in the renderers/ directory read JSON input files provided by the user.\n
- Boundary markers: The skill uses strict JSON schemas (schemas/*.schema.json) with "additionalProperties": false to validate the structure of ingested data.\n
- Capability inventory: The renderers perform local file system read/write operations (fs.readFileSync, fs.writeFileSync) to produce HTML output.\n
- Sanitization: An esc() function in renderers/shared/utils.mjs escapes special characters (& < > " ') to mitigate stored XSS risks in the produced diagrams.
Audit Metadata