charts-flow
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill performs legitimate file operations and diagram rendering. It identifies Mermaid blocks in documentation and moves them to dedicated diagram files.
- [COMMAND_EXECUTION]: The skill utilizes the 'mmdc' command-line interface for local SVG rendering, which is a standard utility.
- [EXTERNAL_DOWNLOADS]: The skill references Mermaid Live (mermaid.live), a well-known service, for rendering diagrams when local tools are unavailable.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface by reading parent documents (BRD, PRD, ADR, SPEC, IPLAN) to extract inline Mermaid blocks. It lacks explicit boundary markers or sanitization for these blocks. However, its capabilities are limited to writing diagram files and executing the 'mmdc' renderer, representing a standard workflow for architectural documentation.
Audit Metadata