readme-visual-kit

Generates three README diagrams (overview, architecture, quickstart) as light and dark SVGs, along with editable JSON, an evidence report and an offline HTML preview. Every diagram node must cite real source file line ranges. The agent writes the manifest and a local Node.js renderer validates and draws it.

See it on GitHub

What it can touch

What it actually does

SKILL.md tells the agent to read the target repository's README and source files, write a visuals.json manifest, then run `node scripts/cli.mjs check` and `render`. The renderer (scripts/cli.mjs, scripts/kit.mjs) does the following: - Validates the manifest's schema strictly. - Resolves each evidence path inside --root. It rejects traversal, absolute paths and symlink escapes, and only accepts UTF-8 text files of 1 MiB or less. - Reads the cited line ranges. - Renders HTML-escaped SVG, HTML and Markdown. - Writes 10 files into a new output directory. It refuses to use an existing directory and opens files with the 'wx' flag, so nothing is overwritten. The renderer makes no network requests, spawns no processes and reads no environment variables or credentials. Only the test suite uses spawnSync, to exercise the CLI. The generated preview's inline script only toggles tabs and theme and copies the snippet to the clipboard. No hidden instructions, prompt injection or obfuscated code was found.

What the check found

Nothing above the low level.

Keep an eye on it

This check is of one commit. Watch readme-visual-kit and we'll email you if a later commit changes what it can touch.

Made this? Add the badge

About this check

Checked November 2, 2026 at commit d2711cfce4cd, 63 files. Rules for known red flags, then two Claude reviews, one of them told to assume the author is malicious. A later commit hasn't been checked. How checks work.