bs-article-illustrate
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
npxfor Mermaid diagram validation and rendering (npx -y @mermaid-js/mermaid-cli -i <file>.mmd -o <file>.svg). - [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto download and execute the@mermaid-js/mermaid-clipackage from the npm registry. It also fetches article content from user-provided URLs during the pre-flight phase. - [PROMPT_INJECTION]: The skill processes untrusted content from external articles, which could contain instructions designed to manipulate the agent's behavior.
- Ingestion points: Article text or URLs provided by the user in the Pre-Flight phase (SKILL.md).
- Boundary markers: Absent; there are no explicit delimiters or instructions to ignore embedded commands within the processed articles.
- Capability inventory: Shell command execution (npx), file system writes (scratch files and temporary diagram files), and network access (URL fetching).
- Sanitization: None; the skill reads and interprets the full article content to identify signals for illustration.
Audit Metadata