writing-skills
Warn
Audited by Gen Agent Trust Hub on Feb 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- COMMAND_EXECUTION (MEDIUM): The script
render-graphs.jsexecutes the systemdotcommand viachild_process.execSync. It processes content extracted fromSKILL.mdby passing it through stdin. While it avoids shell interpolation, it still facilitates the execution of a system utility on untrusted data. - PROMPT_INJECTION (MEDIUM): The files
persuasion-principles.mdandCLAUDE_MD_TESTING.mdimplement and advocate for the use of 'Authority', 'Scarcity', and 'Commitment' principles to force agent compliance. These patterns include directives like 'YOU MUST' and 'No exceptions' aimed at overriding the agent's default decision-making logic and bypassing safety protocols. - EXTERNAL_DOWNLOADS (LOW): The
render-graphs.jsscript identifies missing system dependencies and recommends manual installation commands for the user but does not automate the download process.
Audit Metadata