create-goose-graphics
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the gooseworks package from the npm registry using npx. This is a functional requirement for interacting with the vendor's style catalog.
- [COMMAND_EXECUTION]: Executes npx gooseworks to list and fetch style specifications. This command runs vendor-specific tooling to support the graphics generation workflow.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied visual briefs and incorporates them into HTML frames which are subsequently rendered using Playwright.
- Ingestion points: Visual briefs provided as inputs in SKILL.md.
- Boundary markers: None explicitly defined to separate untrusted brief content from the generated HTML template code.
- Capability inventory: Subprocess execution via npx, file system writes for HTML and PNG exports, and browser-based rendering via the Playwright pipeline.
- Sanitization: The workflow does not describe any escaping, filtering, or validation of the brief content before it is interpolated into HTML files for rendering.
Audit Metadata