color-tools
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes an optional HTTP client (
src/colorfyi/api.py) that interacts withhttps://colorfyi.com. This is standard functionality for the vendor's own REST API. - [DATA_EXPOSURE]: No sensitive file access or credential harvesting patterns were identified. The skill operates on color data using mathematical transformations.
- [COMMAND_EXECUTION]: The CLI and MCP server implementations use standard libraries and do not execute arbitrary shell commands from user input.
- [REMOTE_CODE_EXECUTION]: No remote code execution patterns, such as piped shell scripts or dynamic execution of untrusted data, were found.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests hex color strings which are strictly parsed as hexadecimal integers. This process naturally sanitizes the input, preventing potential injection attacks via processed data.
- [OBFUSCATION]: The source code and documentation are clear and do not contain hidden content, encoded payloads, or homoglyph-based URL spoofing.
Audit Metadata