skills/aeonfun/aeon/weekly-aeoncard/Gen Agent Trust Hub

weekly-aeoncard

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script render_card.py executes the rsvg-convert system utility via subprocess.run to rasterize generated SVG cards. The execution uses a defined argument list and system-derived file paths.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local token usage logs and git metadata.
  • Ingestion points: Reads activity data from memory/token-usage.csv and git remote details.
  • Boundary markers: The summary data is interpolated into notification messages without explicit delimiters.
  • Capability inventory: The skill can write files to the output directory, execute local binaries, and send notifications.
  • Sanitization: The skill utilizes an esc() function to escape HTML/SVG special characters before rendering content, mitigating potential injection risks in visual artifacts.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 03:35 PM