huashu-design

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes scripts/fetch_images.py, which retrieves public domain and Creative Commons images from Wikimedia Commons (commons.wikimedia.org). It also makes requests to svgl.app, simpleicons.org, and Google's favicon service to retrieve official brand logos, and uses standard font/library CDNs like fonts.googleapis.com and unpkg.com for UI rendering. These operations are integral to its function as a design tool.
  • [COMMAND_EXECUTION]: Several scripts (render-video.js, render-video-seek.js, add-music.sh, convert-formats.sh, and mix-voiceover.sh) execute local commands involving ffmpeg, ffprobe, and playwright. These tools are used to render animations into MP4/GIF formats and to mix audio, which is the primary delivery mechanism of the skill.
  • [DYNAMIC_EXECUTION]: The skill uses Playwright's page.evaluate() in scripts like html2pptx.js and pptx_from_rendered.py to calculate the geometry and styles of rendered DOM elements. This dynamic execution is scoped to the browser environment for the purpose of translating HTML designs into PowerPoint objects.
  • [CREDENTIALS_UNSAFE]: references/react-setup.md contains an optional guide for local demonstrations that involves the user entering an Anthropic API key into an input field. The key is used to make direct browser-side requests to the official api.anthropic.com endpoint. The author provides clear security warnings in SECURITY.md regarding the handling of this key and ensures no credentials are hardcoded or exfiltrated to non-official servers.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 01:42 AM