generate-social
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONNO_CODE
Full Analysis
- [SAFE]: The skill does not perform network operations, exfiltrate data, or require external credentials. It generates graphics locally, adhering to privacy and security best practices for social media asset generation.
- [COMMAND_EXECUTION]: The skill utilizes a local Node.js generator (lib/social.mjs) to process brand profiles and layout social media graphics. This execution is limited to Node.js via the allowed-tools constraint in the frontmatter.
- [PROMPT_INJECTION]: The skill processes untrusted user input (headline, subhead, and call-to-action) to populate SVG templates. It mitigates indirect prompt injection and markup injection risks by explicitly instructing that all copy be HTML-escaped before insertion into the SVG markup.
- [NO_CODE]: The core logic resides in external JavaScript files (lib/social.mjs, lib/brand.mjs) which are referenced in the instructions but not included within the skill package files analyzed.
Audit Metadata