create-goose-graphics

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the gooseworks package from the npm registry using npx. This is a functional requirement for interacting with the vendor's style catalog.
  • [COMMAND_EXECUTION]: Executes npx gooseworks to list and fetch style specifications. This command runs vendor-specific tooling to support the graphics generation workflow.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied visual briefs and incorporates them into HTML frames which are subsequently rendered using Playwright.
  • Ingestion points: Visual briefs provided as inputs in SKILL.md.
  • Boundary markers: None explicitly defined to separate untrusted brief content from the generated HTML template code.
  • Capability inventory: Subprocess execution via npx, file system writes for HTML and PNG exports, and browser-based rendering via the Playwright pipeline.
  • Sanitization: The workflow does not describe any escaping, filtering, or validation of the brief content before it is interpolated into HTML files for rendering.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 04:39 PM
Security Audit — agent-trust-hub — create-goose-graphics