goose-graphics-create-style
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands such as
nodeandnpxto run rendering scripts and interact with the style catalog. These are standard operations for the skill's intended purpose. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the Playwright browser and Node.js dependencies from public registries to support its rendering pipeline.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it analyzes untrusted user-provided images. Ingestion points: User images are processed from local paths specified via the
--refparameter in SKILL.md. Boundary markers: None present in the instructions to prevent the model from following text instructions potentially hidden in image metadata or content. Capability inventory: Subprocess execution vianodefor local scripts andnpxfor network-enabled catalog publishing. Sanitization: No explicit sanitization of image content is mentioned, though the risk is reduced by the requirement to use a hardcoded content brief for all generated style examples.
Audit Metadata