banner-design
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill workflow involves executing shell commands (Python and Node.js) that incorporate data from user prompts and local files. This creates a potential surface for indirect prompt injection and command injection. Ingestion points: User-provided prompts and the 'docs/brand-guidelines.md' file referenced in SKILL.md. Boundary markers: No delimiters or ignore-instruction warnings are used when interpolating these values into command arguments. Capability inventory: Commands include 'python3 .claude/skills/ai-artist/scripts/search.py', '.claude/skills/ai-multimodal/scripts/gemini_batch_process.py', and 'node .claude/skills/chrome-devtools/scripts/screenshot.js' as seen in SKILL.md. Sanitization: No evidence of input validation, escaping, or filtering of the content before it is passed to the shell.
- [EXTERNAL_DOWNLOADS]: The skill uses the browser to perform image searches on Pinterest (pinterest.com) for design inspiration. This is an expected design activity and utilizes a well-known service.
Audit Metadata