opendesign-scripts
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the
@opensig/open-scriptspackage via standard package managers (pnpm/npm). It also references a release note document hosted on AtomGit. - [COMMAND_EXECUTION]: The skill documents the use of the
open-scriptsCLI tool for various build tasks including icon generation, SVG cleaning, and component compilation. These commands are typical for a developer tooling skill. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data (SVG files) to be processed into code components. This creates a surface for indirect prompt injection if the source files contain malicious instructions. However, the skill incorporates sanitization practices by recommending the
clean:svgcommand, which uses SVGO to strip potentially dangerous elements like<script>and<style>tags.
Audit Metadata