logo-design
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs several legitimate downloads during its setup process.
- Fetches dependencies from the official NPM and PyPI registries.
- Downloads font files from the official Google Fonts repository on GitHub.
- Downloads a headless Chromium instance via the Playwright library for rendering purposes.
- [COMMAND_EXECUTION]: The skill utilizes local shell and Python scripts for automation and environment management.
setup.shcreates a Python virtual environment and installs necessary packages.- Process replacement (
os.execv) is used infetch_fonts.pyandtext2path.pyto ensure execution occurs within the intended virtual environment. - Subprocesses are used in
selftestscripts to verify the functionality of the rendering and font processing tools. - [DYNAMIC_EXECUTION]: The skill employs dynamic rendering techniques to convert design files.
- Uses Playwright to render user-supplied or repository-resident SVG files into PNG format within a headless browser context.
- This rendering is used for generating mockups and performing pixel-level analysis.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external SVG and image data, which represents a potential ingestion surface.
- Ingestion points: Reads design files (SVG) and reference logos from the user's workspace in
logo-work/. - Boundary markers: Absent for the design data files.
- Capability inventory: Spawns Chromium for rendering and uses graphics libraries like
sharpandfonttoolsfor processing. - Sanitization: Includes SVG syntax validation and PNG header checks before processing.
Audit Metadata