tui-avatar-cropper
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The skill functions as a template for data formatting and TUI generation. It does not perform any sensitive file access, network requests, or command execution.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied JSON data to generate UI layouts. This creates a surface for indirect prompt injection where untrusted data enters the agent context. However, the risk is mitigated by the use of strict, mandatory output delimiters and the absence of executable capabilities (e.g., subprocess calls, network ops) that could be abused by injected instructions.
- [METADATA_POISONING]: The metadata fields (name, description, license) are consistent with the skill's stated purpose and do not contain deceptive instructions.
Audit Metadata