image-to-ui-skill
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The core logic for image generation is encapsulated in a Python script (scripts/image2_asset.py) that uses subprocess.run with argument lists and shlex for safe command parsing, preventing shell injection.
- [SAFE]: The demo validation system (scripts/validate_demo.mjs) includes security measures such as path traversal checks and restricted local server binding to 127.0.0.1.
- [SAFE]: Instructions in SKILL.md and references/ provide clear behavioral boundaries for the agent, focusing on faithful UI recreation without attempting to bypass safety filters or exfiltrate data.
- [SAFE]: No remote script execution patterns, unauthorized downloads, or obfuscated content were detected in the skill files or scripts.
Audit Metadata