typography-x-height-alignment
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a Python script
scripts/xheight.pyto extract metrics from font files and ascripts/selftest.shscript to verify the skill's functionality. These are standard utility scripts for design engineering workflows. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
fonttoolsandbrotliPython packages. These are industry-standard, well-known libraries for font manipulation and decompression. The instructions guide the user to install these from official package registries. - [INDIRECT_PROMPT_INJECTION]: The skill processes binary font files (
.ttf,.otf,.woff2) provided by the user. This represents an ingestion surface for untrusted data. The skill mitigates risks by using the reputablefontToolslibrary to parse the files. Ingestion points are font paths passed to the metrics script, and boundary markers are defined by the library's internal format validation. - [DYNAMIC_EXECUTION]: The
scripts/selftest.shscript dynamically extracts JavaScript code blocks from the skill's own markdown documentation and executes them using Node.js to verify the token emission logic. This is a common practice for self-testing skills and involves only local content from the skill itself.
Audit Metadata