writing-skills
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The provided Node.js script
render-graphs.jsusesexecSyncto invoke the system'sdotcommand (from the Graphviz suite). This functionality is intended to allow developers to visualize skill workflows by rendering Mermaid-like diagrams into SVG files. The script safely provides the diagram source via standard input, which effectively prevents shell-level command injection. - [PROMPT_INJECTION]: Documentation files such as
persuasion-principles.mdandtesting-skills-with-subagents.mdteach methods to enforce agent discipline using authoritative language and non-negotiable framing (e.g., 'YOU MUST', 'Never', 'No exceptions'). While these patterns are designed to ensure an agent adheres to strict protocols like TDD, they represent the same linguistic techniques used in adversarial prompt engineering to override default model behavior. - [EXTERNAL_DOWNLOADS]: The
anthropic-best-practices.mdfile contains several instructional examples showing how to install and utilize external Python and Node.js packages (e.g.,pdfplumber,docx-js). These are provided strictly for educational purposes within the documentation and do not result in automatic downloads or runtime execution of unverified remote code.
Audit Metadata