logo-maker
Pass
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local Node.js scripts (
archive-logo-assets.mjs,render-simple-logo-rgba.mjs) to manage files and open a browser preview. This is intended functionality for the logo design workflow. The scripts use standard Node.js modules and perform path sanitization to prevent directory traversal. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (brand names and requirements) to construct image generation prompts.
- Ingestion points: User requirements provided in the prompt are parsed and stored in a JSON logo brief in
SKILL.mdandSKILL.ko.md. - Boundary markers: The workflow enforces a mandatory structured JSON review step before the final prompt is sent to the image generation model, as specified in the
execution_contract. - Capability inventory: The skill has the capability to write to the
.hypercoredirectory, generate images via the image API, and execute local utility scripts as defined in theSKILL.md. - Sanitization: Brand text is treated as verbatim data within a structured JSON object. The
slugifyfunction inscripts/archive-logo-assets.mjsprevents unsafe characters from being used in directory or file names.
Audit Metadata