svg-add-primitive

Pass

Audited by Gen Agent Trust Hub on Jul 12, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied input through the $ARGUMENTS variable to define the structure and naming of generated code. This creates a surface where malformed input could influence the agent's output.
  • Ingestion points: $ARGUMENTS (external input) and content from lib/primitives/ files.
  • Boundary markers: None present; the skill relies on natural language instructions for the agent to parse the input.
  • Capability inventory: File writing (Write, Edit) and shell execution (Bash for npm test).
  • Sanitization: No explicit sanitization of input is performed beyond the agent's internal logic.
  • [DYNAMIC_EXECUTION]: The skill's core purpose is to generate JavaScript code and verify it by executing a local test suite via npm test. This is a standard automation pattern for software development skills.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill references an absolute Windows path (D:\github_repository\svg-animation-studio\...) for documentation. This is a project-specific reference and does not involve access to sensitive system configurations or user credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 12, 2026, 08:11 PM