minimalistic-graphics
Warn
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions direct the agent to execute an external shell script (setup.sh) located in a relative path (../../kit) outside the skill's folder. This script is not included in the skill package and its contents are unverifiable.
- [DYNAMIC_EXECUTION]: The build.py script dynamically modifies the Python search path to import a module (anim) from an external directory (../../kit). This allows the execution of arbitrary code from a location not governed by the skill's own files.
- [COMMAND_EXECUTION]: The setup process involves running shell commands that depend on a specific directory structure and external resources, increasing the attack surface if the environment is not strictly controlled.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided text for graphics generation without specific boundary markers or sanitization.
- Ingestion points: User-provided text lines for animation in SKILL.md.
- Boundary markers: None present.
- Capability inventory: Python script execution (build.py), file writing (.json), shell execution (setup.sh via agent).
- Sanitization: Only basic string length checks are performed in build.py.
Audit Metadata