brand-icons
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches icon metadata and assets from thesvg.org, a GitHub repository (GLINCKER/thesvg), and Lucide icons via the jsDelivr CDN. These operations are essential to the skill's functionality and target well-known or project-specific repositories.
- [COMMAND_EXECUTION]: The skill invokes several standard command-line utilities via the
subprocessmodule to handle media tasks: - Chromium/Chrome: Used in headless mode to render SVG icons into high-quality PNGs.
- FFmpeg/FFprobe: Used for audio transcription workflows and video rendering within the internal framesmith engine.
- ImageMagick: Utilized as a fallback rasterizer for SVG files when Chromium is unavailable.
- [DATA_EXPOSURE]: The skill integrates with OpenAI services for optional narration and transcription features. It handles the
OPENAI_API_KEYthrough environment variables rather than hardcoding, following standard security practices for API interaction. - [NO_OBFUSCATION]: Analysis of the source code and embedded assets (such as fonts and graphics templates) confirmed that no hidden instructions, encoded payloads, or deceptive patterns are present.
Audit Metadata