drawio-roadmap-swimlane
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided learning outlines (stages, units, and titles) to generate structured .drawio XML files, which presents a surface for indirect instructions to influence the agent's output generation.
- Ingestion points: User-supplied roadmap outlines defined in the 'Build procedure' section of SKILL.md.
- Boundary markers: Absent; there are no specific delimiters or instructions for the agent to ignore potentially malicious instructions embedded in the user's roadmap data.
- Capability inventory: The skill performs file system writes (saving .drawio files to
docs/) and executes a local validation script (scripts/validate_drawio.py). - Sanitization: No explicit sanitization or escaping of the user-provided text is described in the build instructions or implemented in the validation script.
- [COMMAND_EXECUTION]: The skill instructions require the agent to execute a provided Python script to validate the integrity of the generated diagram.
- Evidence: SKILL.md build procedure step 5:
Run python3 scripts/validate_drawio.py <file.drawio>.
Audit Metadata