FlowForge

Pass

Audited by Gen Agent Trust Hub on Jul 9, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill's workflow incorporates the execution of local utility scripts, specifically scripts/validate.py for XML schema and layout verification, and scripts/render.sh for generating image previews. These operations are scoped to the skill's primary function of diagram generation.
  • [EXTERNAL_DOWNLOADS]: The documentation provides instructions for users to optionally install the draw.io desktop application via Homebrew (brew install --cask drawio). This refers to a well-known, trusted visualization service and is intended to enable the skill's rendering features.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-supplied documents or articles to automatically propose and generate diagrams. While this creates a potential attack surface for instructions embedded in external data, the skill includes a deterministic validation script that parses the resulting XML for structural integrity.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 9, 2026, 02:50 PM
Security Audit — agent-trust-hub — FlowForge