svg-mascot-animator
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The scripts/setup.sh script installs the animejs package from the npm registry. Additionally, SKILL.md and assets/runtime-scene.html reference the esm.sh and jsdelivr CDNs for importing the library. These are well-known and standard services for web development.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided SVG files, which constitutes an attack surface for indirect prompt injection. * Ingestion points: External SVG files are read and parsed in scripts/inspect_svg.py, scripts/pixel-source-model.mjs, and scripts/check_asset.py. * Boundary markers: No specific delimiters or 'ignore instructions' warnings are used when the agent reads or processes the content of the SVG files. * Capability inventory: The skill possesses the capability to write files to the local system via scripts/generate-mascot-packs.mjs and execute local scripts. * Sanitization: The skill employs xmlEscape when generating SVG output and uses scripts/check_asset.py to validate that generated assets do not contain scripts, external fonts, or unauthorized external references.
Audit Metadata