custom-icons
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates the use of local Python scripts and external command-line tools like
potraceandsvgoto transform and optimize icon assets. All commands are strictly limited to the intended asset-processing workflow.- [EXTERNAL_DOWNLOADS]: The skill utilizes the standardpillowPython package and thesvgoNode.js package (viabunx). These dependencies are well-known, trusted tools within the image processing ecosystem.- [INDIRECT_PROMPT_INJECTION]: The skill addresses potential risks from external data by using a custom validator (validate_icon.py) that enforces security constraints on SVG files, specifically forbidding<script>,<foreignObject>, and<image>tags, as well as externalhrefreferences.
Audit Metadata