Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed diagram-generation client that sends the current request to a configured ContextWeave backend, with some privacy and usability caveats but no artifact-backed malicious behavior.
Before installing, confirm you trust the configured ContextWeave backend and avoid submitting confidential documents unless that service's privacy and retention terms are acceptable. Expect the skill to create request files in the current workspace and attempt a Node-based generation command when used.
The skill sends structured user content to a backend service but does not require a clear privacy disclosure or user consent before transmission. Because the tool is designed to transform potentially complex documents and knowledge into diagrams, users may provide sensitive business, architectural, or proprietary data that is then exfiltrated to an external service without adequate notice.
The skill explicitly requires writing a request file and executing a local Node.js script as part of the default flow, but it does not require a user-facing warning or confirmation before taking those system-impacting actions. Even though the actions are within the skill's intended function, automatic file creation and command execution increase risk of unintended side effects, especially in agentic environments where users may not realize code will be run locally.
No suspicious patterns detected.
