Security audit
Security checks for vulnerabilities and agentic risk
PaintForge is a coherent diagram-generation skill with disclosed local rendering, optional preview/browser checks, and bounded optional brand/repository lookups.
Install only if you want a local diagram-rendering tool that can create and replace chosen HTML outputs. Be aware that optional brand capture fetches a user-supplied HTTP(S) URL, repository evidence reads a specified local Git checkout, preview starts a loopback server, and visual-check may launch Chrome and write screenshot sidecars.
Referenced artifact was not completely inspected
2. Read one matching schema in `schemas/`, `schemas/common.schema.json`, and one matching JSON example in `examples/`. Read only those files. Fresh authorship m
Referenced artifact was not completely inspected
ting workflow's fixed geometry. When real product identity matters, query `node bin/paintforge.mjs brands "<name>" --json`; read `references/brand-marks.md` onl
Referenced artifact was not completely inspected
ting workflow's fixed geometry. When real product identity matters, query `node bin/paintforge.mjs brands "<name>" --json`; read `references/brand-marks.md` onl
Referenced artifact was not completely inspected
ting workflow's fixed geometry. When real product identity matters, query `node bin/paintforge.mjs brands "<name>" --json`; read `references/brand-marks.md` onl
Referenced artifact was not completely inspected
ting workflow's fixed geometry. When real product identity matters, query `node bin/paintforge.mjs brands "<name>" --json`; read `references/brand-marks.md` onl
Referenced artifact was not completely inspected
ting workflow's fixed geometry. When real product identity matters, query `node bin/paintforge.mjs brands "<name>" --json`; read `references/brand-marks.md` onl
Referenced artifact was not completely inspected
ting workflow's fixed geometry. When real product identity matters, query `node bin/paintforge.mjs brands "<name>" --json`; read `references/brand-marks.md` onl
Referenced artifact was not completely inspected
ting workflow's fixed geometry. When real product identity matters, query `node bin/paintforge.mjs brands "<name>" --json`; read `references/brand-marks.md` onl
Referenced artifact was not completely inspected
ting workflow's fixed geometry. When real product identity matters, query `node bin/paintforge.mjs brands "<name>" --json`; read `references/brand-marks.md` onl
Referenced artifact was not completely inspected
ting workflow's fixed geometry. When real product identity matters, query `node bin/paintforge.mjs brands "<name>" --json`; read `references/brand-marks.md` onl
Referenced artifact was not completely inspected
ting workflow's fixed geometry. When real product identity matters, query `node bin/paintforge.mjs brands "<name>" --json`; read `references/brand-marks.md` onl
Referenced artifact was not completely inspected
identity matters, query `node bin/paintforge.mjs brands "<name>" --json`; read `references/brand-marks.md` only for an unknown brand with a user-provided URL.
Referenced artifact was not completely inspected
Do not read `renderers/shared/geometry.mjs`, renderer source, validator source, tests, or benchmarks before the first candidate. Inspect implementation only for
Referenced artifact was not completely inspected
contract is in [`renderers/workflow/README.md`](renderers/workflow/README.md#layout-contracts).
Referenced artifact was not completely inspected
ng>` fall back to English. The renderer never translates authored content. See `references/authoring-contract.md` for details.
Referenced artifact was not completely inspected
ng>` fall back to English. The renderer never translates authored content. See `references/authoring-contract.md` for details.
Referenced artifact was not completely inspected
readable measurements and screenshots do not approve perceptual polish. Follow `references/delivery-contract.md` for the canonical receipt fields, coverage, sid
Referenced artifact was not completely inspected
readable measurements and screenshots do not approve perceptual polish. Follow `references/delivery-contract.md` for the canonical receipt fields, coverage, sid
Referenced artifact was not completely inspected
readable measurements and screenshots do not approve perceptual polish. Follow `references/delivery-contract.md` for the canonical receipt fields, coverage, sid
Referenced artifact was not completely inspected
Read `references/viewer-runtime.md` only when the user explicitly asks for Share Cards, Route/Reach cards, motion, guided stories, deep links, presentation, sea
Referenced artifact was not completely inspected
When shell access is unavailable, hand-place architecture SVG into `assets/template.html`, use CSS semantic classes rather than inline colors, and follow the vi
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<text x="300" y="595" class="t-muted" font-size="9" text-anchor="middle">More info</text>
<text x="300" y="615" class="t-frontend" font-size="8" text-anchor="middle">domain.example.com</text>
<!-- =================================================================
ARROW EXAMPLES (use .a-* classes and stroke-width on the line)
================================================================= -->
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
</style>
</head>
<body>
<!-- Toolbar: theme, live visual style, trace motion, presentation stage, and export.
Motion appears only for trace-enabled artifacts and has no shortcut;
Keyboard: T toggles theme, S cycles style, F toggles the stage, E opens export. -->
<div class="toolbar" role="toolbar" aria-label="Diagram actions">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
</style>
</head>
<body>
<!-- Toolbar: theme, live visual style, trace motion, presentation stage, and export.
Motion appears only for trace-enabled artifacts and has no shortcut;
Keyboard: T toggles theme, S cycles style, F toggles the stage, E opens export. -->
<div class="toolbar" role="toolbar" aria-label="Diagram actions">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
</style>
</head>
<body>
<!-- Toolbar: theme, live visual style, trace motion, presentation stage, and export.
Motion appears only for trace-enabled artifacts and has no shortcut;
Keyboard: T toggles theme, S cycles style, F toggles the stage, E opens export. -->
<div class="toolbar" role="toolbar" aria-label="Diagram actions">
Detected: suspicious.dangerous_exec