magazine-explainer

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses several shell scripts (render.sh, fetch_image.sh, booklet.sh, printable.sh, print_booklet.sh) to perform its duties. These scripts invoke system commands such as curl, lp, python, pdftoppm, and headless Google Chrome.
  • [COMMAND_EXECUTION]: The scripts/make_printable.py script uses subprocess.run to call pdftoppm for rasterizing PDF pages. This is a functional requirement for the skill's purpose of ensuring print compatibility and does not use untrusted input in a way that enables injection.
  • [EXTERNAL_DOWNLOADS]: scripts/fetch_image.sh uses curl to download images from user-provided URLs. It includes a browser User-Agent and referer to avoid blocking by CDNs. The skill instructions explicitly tell the agent to 'Read each downloaded image to confirm it's the right subject' and not a 404 or logo before use.
  • [DATA_EXPOSURE]: The skill instructions mention reading ~/.claude/PROSE.md and invoking a stop-slop skill to audit writing quality. This accesses local configuration files intended for agent behavior customization, which is standard for this platform environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 05:43 AM
Security Audit — agent-trust-hub — magazine-explainer