magazine-explainer
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses several shell scripts (
render.sh,fetch_image.sh,booklet.sh,printable.sh,print_booklet.sh) to perform its duties. These scripts invoke system commands such ascurl,lp,python,pdftoppm, and headlessGoogle Chrome. - [COMMAND_EXECUTION]: The
scripts/make_printable.pyscript usessubprocess.runto callpdftoppmfor rasterizing PDF pages. This is a functional requirement for the skill's purpose of ensuring print compatibility and does not use untrusted input in a way that enables injection. - [EXTERNAL_DOWNLOADS]:
scripts/fetch_image.shusescurlto download images from user-provided URLs. It includes a browser User-Agent and referer to avoid blocking by CDNs. The skill instructions explicitly tell the agent to 'Read each downloaded image to confirm it's the right subject' and not a 404 or logo before use. - [DATA_EXPOSURE]: The skill instructions mention reading
~/.claude/PROSE.mdand invoking astop-slopskill to audit writing quality. This accesses local configuration files intended for agent behavior customization, which is standard for this platform environment.
Audit Metadata