suggest-lucide-icons
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches SVG files from
unpkg.comto verify that proposed icon names are valid. This process targets a well-known CDN and is used solely for asset verification. - [COMMAND_EXECUTION]: The process instructions allow for the use of
curl -Lto handle redirects and check the existence of remote SVG files. This usage is scoped to the icon verification task. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it processes external inputs to drive its logic.
- Ingestion points: The
ConceptandScreenshotinputs inSKILL.mdserve as entry points for untrusted data. - Boundary markers: No specific delimiters or instructions are provided to the agent to treat user-provided data as data only or to ignore embedded instructions.
- Capability inventory: The agent uses network tools like
WebFetchorcurlto interact with external URLs based on processed input. - Sanitization: There is no explicit requirement for the agent to sanitize or validate the icon names generated from user input before attempting to fetch them.
Audit Metadata