plannotator-visual-explainer

Warn

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to dynamically install a dependency at runtime if it is missing. Specifically, it suggests using npx skills add nicobailon/visual-explainer -g --yes to fetch and install an external skill globally without manual confirmation.
  • [COMMAND_EXECUTION]: The skill uses a custom CLI tool, plannotator, to deliver output and enforce gates. Commands like plannotator annotate <file> --gate and plannotator annotate <file> are used to process and display the generated HTML content. It also assumes the presence of npx for package installation.
  • [DYNAMIC_EXECUTION]: The SKILL.test.ts file contains logic that uses the new Function() constructor to execute code strings extracted from documentation. While this is part of the test suite (using Bun's test runner) to verify Mermaid configurations, it represents a pattern of executing string-based code.
  • [REMOTE_CODE_EXECUTION]: The PR path instructions recommend using the Pierre diffs library via a CDN (https://cdn.jsdelivr.net/npm/@pierre/diffs@1.1.21/+esm) inside the generated HTML. This causes the final visualization to load and execute third-party JavaScript from an external provider when viewed in a browser.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 15, 2026, 12:43 AM
Security Audit — agent-trust-hub — plannotator-visual-explainer