code-to-diagram

Pass

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/analyze_codebase.py uses subprocess.run to invoke the mmdc (Mermaid CLI) tool. This is used for the functional purpose of rendering Mermaid diagrams into SVG files. The command is constructed using a list of arguments and does not use shell=True, which is a secure implementation that prevents shell injection.
  • [EXTERNAL_DOWNLOADS]: The skill mentions @mermaid-js/mermaid-cli as an optional dependency in its documentation. This is a well-known open-source tool used for diagram rendering. The skill does not attempt to automatically download or install any external software.
  • [DATA_EXPOSURE]: The tool reads local files within a user-specified directory to perform AST and regex parsing for dependency mapping. These operations are performed entirely on the local system, and there are no network operations present to exfiltrate the parsed data.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 13, 2026, 02:06 AM
Security Audit — agent-trust-hub — code-to-diagram