FlowForge
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill's workflow incorporates the execution of local utility scripts, specifically
scripts/validate.pyfor XML schema and layout verification, andscripts/render.shfor generating image previews. These operations are scoped to the skill's primary function of diagram generation. - [EXTERNAL_DOWNLOADS]: The documentation provides instructions for users to optionally install the
draw.iodesktop application via Homebrew (brew install --cask drawio). This refers to a well-known, trusted visualization service and is intended to enable the skill's rendering features. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-supplied documents or articles to automatically propose and generate diagrams. While this creates a potential attack surface for instructions embedded in external data, the skill includes a deterministic validation script that parses the resulting XML for structural integrity.
Audit Metadata