editor-gizmo

Pass

Audited by Gen Agent Trust Hub on Jun 17, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: Detailed analysis of the skill's source code and logic found no malicious intent, obfuscation, or safety guideline bypasses.
  • [EXTERNAL_DOWNLOADS]: Fetches UI icons from the established Iconify CDN (api.iconify.design). This is a well-known service used for retrieving graphical assets and is standard practice for modern web-based UIs.
  • [DATA_EXFILTRATION]: Uses signedFetch and fetch to send entity transform data to the local project's preview server at the /editor/changes endpoint. This operation is scoped to the development environment and is the intended mechanism for persisting visual edits to the scene's source files.
  • [COMMAND_EXECUTION]: Includes user instructions in SKILL.md for manual installation using standard shell commands (mkdir, cp). These commands are not executed automatically by the skill and require manual user intervention.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 17, 2026, 11:52 AM
Security Audit — agent-trust-hub — editor-gizmo