skills/efoo-team/skills/logo-design/Gen Agent Trust Hub

logo-design

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill performs several legitimate downloads during its setup process.
  • Fetches dependencies from the official NPM and PyPI registries.
  • Downloads font files from the official Google Fonts repository on GitHub.
  • Downloads a headless Chromium instance via the Playwright library for rendering purposes.
  • [COMMAND_EXECUTION]: The skill utilizes local shell and Python scripts for automation and environment management.
  • setup.sh creates a Python virtual environment and installs necessary packages.
  • Process replacement (os.execv) is used in fetch_fonts.py and text2path.py to ensure execution occurs within the intended virtual environment.
  • Subprocesses are used in selftest scripts to verify the functionality of the rendering and font processing tools.
  • [DYNAMIC_EXECUTION]: The skill employs dynamic rendering techniques to convert design files.
  • Uses Playwright to render user-supplied or repository-resident SVG files into PNG format within a headless browser context.
  • This rendering is used for generating mockups and performing pixel-level analysis.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external SVG and image data, which represents a potential ingestion surface.
  • Ingestion points: Reads design files (SVG) and reference logos from the user's workspace in logo-work/.
  • Boundary markers: Absent for the design data files.
  • Capability inventory: Spawns Chromium for rendering and uses graphics libraries like sharp and fonttools for processing.
  • Sanitization: Includes SVG syntax validation and PNG header checks before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 09:18 AM