huashu-design
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes
scripts/fetch_images.py, which retrieves public domain and Creative Commons images from Wikimedia Commons (commons.wikimedia.org). It also makes requests tosvgl.app,simpleicons.org, and Google's favicon service to retrieve official brand logos, and uses standard font/library CDNs likefonts.googleapis.comandunpkg.comfor UI rendering. These operations are integral to its function as a design tool. - [COMMAND_EXECUTION]: Several scripts (
render-video.js,render-video-seek.js,add-music.sh,convert-formats.sh, andmix-voiceover.sh) execute local commands involvingffmpeg,ffprobe, andplaywright. These tools are used to render animations into MP4/GIF formats and to mix audio, which is the primary delivery mechanism of the skill. - [DYNAMIC_EXECUTION]: The skill uses Playwright's
page.evaluate()in scripts likehtml2pptx.jsandpptx_from_rendered.pyto calculate the geometry and styles of rendered DOM elements. This dynamic execution is scoped to the browser environment for the purpose of translating HTML designs into PowerPoint objects. - [CREDENTIALS_UNSAFE]:
references/react-setup.mdcontains an optional guide for local demonstrations that involves the user entering an Anthropic API key into an input field. The key is used to make direct browser-side requests to the officialapi.anthropic.comendpoint. The author provides clear security warnings inSECURITY.mdregarding the handling of this key and ensures no credentials are hardcoded or exfiltrated to non-official servers.
Audit Metadata