ios-app-icon-generator
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructs the agent to generate an HTML artifact containing JavaScript to facilitate the conversion of SVG icons to PNG format for download. This is a legitimate functional requirement for the skill's primary purpose.
- Evidence: Found in 'Phase 2: Icon Generation' which specifies an HTML structure with a script block for 'SVG → Canvas → PNG download logic'.
- [INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect injection by ingesting untrusted user data (app names, brand colors, and purpose) and interpolating them into generated HTML content.
- Ingestion points: User-supplied app name, purpose, and visual requirements in SKILL.md under the 'Process' section.
- Boundary markers: None present; the skill lacks explicit instructions to delimit user-provided strings within the generated HTML template.
- Capability inventory: Ability to generate and write HTML/JS files that are rendered in the user's local environment.
- Sanitization: No explicit sanitization or escaping guidelines are provided for handling user-supplied text when creating the HTML title or content fields.
Audit Metadata