ape-present
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONNO_CODE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches content from user-provided URLs using
WebFetchorcurl. It also references specific external fonts viafonts.googleapis.comand theMathJaxlibrary viacdn.jsdelivr.net. These are within the scope of well-known/trusted services and are used for their intended primary purpose of document rendering and typesetting. - [COMMAND_EXECUTION]: The skill provides instructions for the agent to use local tools like
pdftotext,grep,wc,python3, andbash. These commands are used for content extraction (pdftotext), build automation (injecting CSS/JS via a Python script), and verification of the output quality (verify.sh). The commands are restricted to the local workspace and intended for legitimate workflow automation. - [NO_CODE]: The skill does not distribute its own executable binary files. It relies on a provided markdown-based visual system, CSS/JS reference files, and a shell verification script which are processed through the agent's environment.
- [REMOTE_CODE_EXECUTION]: The verification process uses
bash <(curl -s [URL])patterns in the developer documentation (global rules) but the actual skill uses a local scriptbash <skill-dir>/reference/verify.sh. No piping of unknown remote URLs to shell was detected in the skill instructions.
Audit Metadata