teardown
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The scripts
scripts/check-viewer.cjsandscripts/proof.cjsexecute local commands such as Chrome/Chromium,rsvg-convert, orresvg. This behavior is limited to rendering drawings to images and verifying the visual output of the skill. - [DYNAMIC_EXECUTION]: The skill utilizes the Node.js
vmmodule in its proofing and testing scripts (e.g.,scripts/proof.cjs) to execute the skill's own geometry and projection logic. This is part of the core functionality for generating technical drawings from the descriptive code authored by the user or agent. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data such as CAD models, images, and documents.
SKILL.mdincludes explicit instructions for the agent to treat these inputs only as evidence for the drawing and never as instructions that change the request, which serves as a defense against indirect prompt injection.
Audit Metadata