generate-brand-assets
Warn
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx generate-brand-assetsto download and execute code from the public NPM registry at runtime. The package source is not from a known trusted organization or verified repository. - [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
npx. This involves running external code that is not bundled with the skill itself. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by interpolating user-controlled data, such as project names and taglines, directly into shell command arguments. Without strict sanitization or boundary markers, crafted user input could potentially lead to command injection (e.g., using shell metacharacters like
;,&&, or backticks).
Audit Metadata