terminal-screenshot
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation provides instructions for installing the
freezeutility from its official GitHub repository and via Homebrew. These are well-known sources for developer tools. The instructions include a regional Go proxy mirror and a flag to disable checksum verification (GOSUMDB=off), which is documented as a workaround for specific network environments during manual installation by the user. - [COMMAND_EXECUTION]: The
render_ansi.shscript executes local binaries (freezeorGoogle Chrome) to perform image rendering. The script safely quotes variables derived from command-line arguments to prevent command injection vulnerabilities. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted terminal output.
- Ingestion points: Processes
.ansifiles generated from various CLI tools as described inSKILL.md. - Capability inventory: Executes rendering commands in
render_ansi.shand file operations inansi2html.py. - Sanitization: The
ansi2html.pyscript correctly utilizeshtml.escape()to sanitize terminal output before wrapping it in HTML for rendering, mitigating the risk of injection through the browser fallback path.
Audit Metadata