plannotator-visual-explainer
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to dynamically install a dependency at runtime if it is missing. Specifically, it suggests using
npx skills add nicobailon/visual-explainer -g --yesto fetch and install an external skill globally without manual confirmation. - [COMMAND_EXECUTION]: The skill uses a custom CLI tool,
plannotator, to deliver output and enforce gates. Commands likeplannotator annotate <file> --gateandplannotator annotate <file>are used to process and display the generated HTML content. It also assumes the presence ofnpxfor package installation. - [DYNAMIC_EXECUTION]: The
SKILL.test.tsfile contains logic that uses thenew Function()constructor to execute code strings extracted from documentation. While this is part of the test suite (using Bun's test runner) to verify Mermaid configurations, it represents a pattern of executing string-based code. - [REMOTE_CODE_EXECUTION]: The PR path instructions recommend using the Pierre diffs library via a CDN (
https://cdn.jsdelivr.net/npm/@pierre/diffs@1.1.21/+esm) inside the generated HTML. This causes the final visualization to load and execute third-party JavaScript from an external provider when viewed in a browser.
Audit Metadata