Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed diagram generator that creates local SVG/PNG files, with minor caution around broad activation phrases and output paths.
Install this if you want an agent to generate diagram files locally. Be explicit about when you want a diagram and where outputs should be written, especially in shared or important directories.
The skill declares very broad trigger phrases such as 'visualize', 'create chart', and generic Chinese phrases like '帮我画'/'生成图', plus it triggers on 'any system/flow description.' This can cause unintended activation in normal conversation, leading the agent to switch into file-generating behavior unexpectedly and potentially execute follow-on tool actions the user did not clearly request.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<!-- r=circumradius. For r=36: points at 36,0 18,31.2 -18,31.2 -36,0 -18,-31.2 18,-31.2 -->
<polygon points="cx,cy-r cx+r*0.866,cy-r*0.5 cx+r*0.866,cy+r*0.5 cx,cy+r cx-r*0.866,cy+r*0.5 cx-r*0.866,cy-r*0.5"
fill="FILL" stroke="STROKE" stroke-width="1.5"/>
<text x="cx" y="cy+5" text-anchor="middle" fill="TEXT" font-size="12" font-weight="600">Agent</text>
The skill instructs writing SVG/PNG files to disk and even provides a Python snippet that writes to an arbitrary path, but it does not require user consent, path confirmation, or safety checks. In an agent environment with file system tools, this can lead to unexpected persistence, overwriting files, or writing outputs to sensitive or unintended locations.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.insert(2, str(width))
try:
result = subprocess.run(cmd, capture_output=True, timeout=30)
return result.returncode == 0
except (subprocess.TimeoutExpired, Exception):
return False
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Install one of:
1. rsvg-convert (recommended):
macOS: brew install librsvg
Ubuntu: sudo apt install librsvg2-bin
2. cairosvg (Python):
pip install cairosvg
No suspicious patterns detected.