preline-theme-generator
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill relies entirely on local scripts and explicitly prohibits the use of
npxor other network-dependent tools, effectively mitigating supply chain and remote code execution risks. - [SAFE]: The generator script (
scripts/generate-theme.js) implements strict input validation, including a regular expression check for theme names (/^[a-z][a-z0-9-]*$/) to prevent directory traversal or malicious filename creation through user-supplied names. - [SAFE]: File system discovery is restricted by an internal allowlist of trusted directories in
scripts/find-themes-dir.js, preventing the agent from performing broad or unauthorized system scans. - [SAFE]: Theme generation logic uses calculated color values and static templates, ensuring that user-provided text (like moods or names) cannot be used to inject malicious CSS or escape the intended generation logic.
- [SAFE]: The
SKILL.mdfile contains robust security instructions that command the agent to avoid arbitrary command execution and to only write files to user-confirmed, validated paths.
Audit Metadata