terminal-screenshot

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill documentation provides instructions for installing the freeze utility from its official GitHub repository and via Homebrew. These are well-known sources for developer tools. The instructions include a regional Go proxy mirror and a flag to disable checksum verification (GOSUMDB=off), which is documented as a workaround for specific network environments during manual installation by the user.
  • [COMMAND_EXECUTION]: The render_ansi.sh script executes local binaries (freeze or Google Chrome) to perform image rendering. The script safely quotes variables derived from command-line arguments to prevent command injection vulnerabilities.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted terminal output.
  • Ingestion points: Processes .ansi files generated from various CLI tools as described in SKILL.md.
  • Capability inventory: Executes rendering commands in render_ansi.sh and file operations in ansi2html.py.
  • Sanitization: The ansi2html.py script correctly utilizes html.escape() to sanitize terminal output before wrapping it in HTML for rendering, mitigating the risk of injection through the browser fallback path.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 04:13 PM