svg-add-primitive
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied input through the
$ARGUMENTSvariable to define the structure and naming of generated code. This creates a surface where malformed input could influence the agent's output. - Ingestion points:
$ARGUMENTS(external input) and content fromlib/primitives/files. - Boundary markers: None present; the skill relies on natural language instructions for the agent to parse the input.
- Capability inventory: File writing (
Write,Edit) and shell execution (Bashfornpm test). - Sanitization: No explicit sanitization of input is performed beyond the agent's internal logic.
- [DYNAMIC_EXECUTION]: The skill's core purpose is to generate JavaScript code and verify it by executing a local test suite via
npm test. This is a standard automation pattern for software development skills. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill references an absolute Windows path (
D:\github_repository\svg-animation-studio\...) for documentation. This is a project-specific reference and does not involve access to sensitive system configurations or user credentials.
Audit Metadata