generate-icon
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
Bun.spawnSyncinscripts/process.tsto execute local CLI toolsconvert(from ImageMagick) andiconutil(macOS native utility). These commands are used to bundle multiple PNG icons into standard container formats like.icoand.icnsas part of the icon generation pipeline. - [EXTERNAL_DOWNLOADS]: The script performs network operations to
api.replicate.comto utilize therembgmodel for background removal. It also interacts with Google's Gemini API for image generation. Both are well-known AI infrastructure providers used here for their primary intended functions. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text prompts and reference images which are interpolated into an image generation template.
- Ingestion points: User input via the
promptargument and the optional--inputimage path inscripts/generate.ts. - Boundary markers: The user prompt is placed within a hardcoded template, though it lacks explicit "ignore instructions" delimiters for the image model.
- Capability inventory: The skill can perform network requests, file system writes, and execute shell commands (
convert,iconutil). - Sanitization: No text sanitization is performed on the user prompt. However, the skill specifically instructs the agent not to read the resulting images back into the context, effectively breaking the feedback loop required for an indirect injection to affect the agent's behavior.
Audit Metadata