Security audit
Security checks for vulnerabilities and agentic risk
This is a simple Graphviz diagram skill that discloses its online rendering link workflow and does not contain code, hidden persistence, credential access, or destructive behavior.
Before installing, understand that generated DOT content is placed into a GraphvizOnline URL for rendering. Do not include secrets, credentials, private schemas, or sensitive internal architecture in diagrams you would not want opened in a third-party web page.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- "Draw the architecture of my microservices"
- "Make a flowchart for user registration"
- "Visualize dependencies between modules"
- "Create an ER diagram for the database"
## Requirements
The README says diagrams are rendered online via GraphvizOnline but does not clearly warn that user-supplied content will be sent to a third-party external service. If users include internal architecture, database schemas, secrets, or proprietary dependency information, that data may be exposed outside the local environment without informed consent.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
SKILL.md file:
mkdir -p ~/.claude/skills/graphviz
cp SKILL.md ~/.claude/skills/graphviz/
The README states the skill activates automatically for broad prompts like 'draw, visualize, or diagram something,' which can cause unintended invocation in contexts where users did not mean to use this skill. Over-broad triggering increases the chance that sensitive architectural or system information is processed and then routed into the skill's external rendering workflow without clear user intent.
The skill's activation criteria are broad enough to match many generic requests for diagrams or visualizations, which can cause the agent to invoke this skill in situations where a more specific or safer tool should be chosen. This is not code execution or data exfiltration by itself, but it increases the attack surface for prompt-routing mistakes and unintended tool use.
The example trigger includes a catch-all phrase that can overmatch ordinary user requests, making the skill eligible for activation in ambiguous contexts. In agent systems, broad trigger language can lead to inappropriate delegation, reduced predictability, and increased exposure to prompt-injection opportunities through unnecessary tool invocation.
No suspicious patterns detected.