writing-skills
Pass
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The utility script
render-graphs.jsexecutes the system'sdotcommand viachild_process.execSyncto generate SVG diagrams from Graphviz code blocks extracted from markdown files. This is a local visualization tool intended for skill authors.\n- [PROMPT_INJECTION]: The skill documentation incorporates strong imperative language and behavioral steering principles, such as Authority and Commitment, to ensure agent compliance with strict TDD workflows. While these linguistic patterns resemble those used in prompt injections, they are applied here to define internal operational discipline and process enforcement rather than to bypass safety guardrails.\n- [SAFE]: File system access is restricted to the skill's own directory and standard agent configuration paths (~/.claude/skills) for managing and documenting skills. No remote execution from untrusted sources, external data exfiltration, or hardcoded credentials were found.
Audit Metadata