skills/venhdev/skills/writing-skills/Gen Agent Trust Hub

writing-skills

Pass

Audited by Gen Agent Trust Hub on Jun 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The provided Node.js script render-graphs.js uses execSync to invoke the system's dot command (from the Graphviz suite). This functionality is intended to allow developers to visualize skill workflows by rendering Mermaid-like diagrams into SVG files. The script safely provides the diagram source via standard input, which effectively prevents shell-level command injection.
  • [PROMPT_INJECTION]: Documentation files such as persuasion-principles.md and testing-skills-with-subagents.md teach methods to enforce agent discipline using authoritative language and non-negotiable framing (e.g., 'YOU MUST', 'Never', 'No exceptions'). While these patterns are designed to ensure an agent adheres to strict protocols like TDD, they represent the same linguistic techniques used in adversarial prompt engineering to override default model behavior.
  • [EXTERNAL_DOWNLOADS]: The anthropic-best-practices.md file contains several instructional examples showing how to install and utilize external Python and Node.js packages (e.g., pdfplumber, docx-js). These are provided strictly for educational purposes within the documentation and do not result in automatic downloads or runtime execution of unverified remote code.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 23, 2026, 08:03 AM
Security Audit — agent-trust-hub — writing-skills