asset-composite
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses pnpm to install the 'sharp' library. Sharp is a well-known, high-performance, and trusted Node.js module for image processing.
- [SAFE]: The skill reads branding configuration from 'src/lib/config/tenant.config.ts'. This access is necessary for maintaining consistent visual standards in the generated assets.
- [PROMPT_INJECTION]: The skill processes labels and layout instructions provided in arguments and interpolates them into AI prompts and HTML templates, which constitutes a surface for indirect prompt injection.
- Ingestion points: Image labels and layout instructions sourced from the $ARGUMENTS variable.
- Boundary markers: There are no delimiters or specific instructions provided to isolate user-supplied text from the system instructions.
- Capability inventory: The skill possesses 'Read', 'Write', and 'Bash' capabilities, allowing it to manipulate the local file system.
- Sanitization: The instructions do not implement any sanitization or validation of input strings before they are used in generation or rendering.
Audit Metadata