ai-skills
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- COMMAND_EXECUTION (LOW): The script
scripts/render_dot.pyinvokes the systemdotbinary viasubprocess.run. This is essential for the skill's purpose of rendering diagrams and uses a safe argument list to prevent shell injection. - EXTERNAL_DOWNLOADS (LOW): The
scripts/render_dot.pyfile includes auvmetadata block requiring thegraphvizpackage. This results in an external download from the Python Package Index (PyPI) at runtime. - DATA_EXFILTRATION (SAFE): No patterns indicating the exfiltration of sensitive data or unauthorized network access were detected.
- PROMPT_INJECTION (SAFE): The skill instructions and best practices do not contain attempts to override agent safety protocols or hijack the session context.
Audit Metadata