aiz-infographic
Fail
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The README.md and install.sh recommend installation by piping a remote shell script to bash. Evidence:
curl -fsSL https://raw.githubusercontent.com/aizzaku/aiz-infographic/main/install.sh | bash. - [EXTERNAL_DOWNLOADS]: The skill installs Playwright and Chromium dependencies. It also references assets from Google Fonts, Phosphor Icons, and Iconify at runtime.
- [COMMAND_EXECUTION]: The skill runs a local Python script (scripts/export.py) which executes browser commands to render images.
- [DATA_EXFILTRATION]: The skill possesses a surface for indirect prompt injection. Ingestion points: User-provided data in prompt. Boundary markers: Absent in generated HTML. Capability inventory: File-write and command execution. Sanitization: Partial removal of symbols in browser tools.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/aizzaku/aiz-infographic/main/install.sh - DO NOT USE without thorough review
Audit Metadata