docs-diagrams
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- External Resource Access: The workflow involves downloading reference images from Vercel's official blob storage service (vercel-storage.com). This is a legitimate operation used to provide visual context for diagram creation.
- Dynamic Module Loading: The generation script uses dynamic imports to load diagram definitions from the local diagrams/ directory. This is a common pattern for extensible build tools and is appropriately scoped to local files.
- Subprocess Execution: The skill orchestrates multiple environments (Bash, Node.js, Python, and Chrome) to convert SVG code into final PNG assets. These executions follow standard CLI patterns and are intended for the skill's primary rendering functions.
- Indirect Prompt Injection Surface: The skill ingests data from local documentation and external references to inform diagram content. Potential risks are managed through explicit text escaping in the SVG generation logic and by maintaining an execution scope restricted to the intended build workflow.
Audit Metadata