custom-icons

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill orchestrates the use of local Python scripts and external command-line tools like potrace and svgo to transform and optimize icon assets. All commands are strictly limited to the intended asset-processing workflow.- [EXTERNAL_DOWNLOADS]: The skill utilizes the standard pillow Python package and the svgo Node.js package (via bunx). These dependencies are well-known, trusted tools within the image processing ecosystem.- [INDIRECT_PROMPT_INJECTION]: The skill addresses potential risks from external data by using a custom validator (validate_icon.py) that enforces security constraints on SVG files, specifically forbidding <script>, <foreignObject>, and <image> tags, as well as external href references.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 10:45 PM