layer-typography
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill allows for font files to be uploaded from public URLs via the
upload_filetool. This is a legitimate feature for typography tasks and utilizes the vendor's standard file handling services. - [COMMAND_EXECUTION]: Documentation includes a command (
npx skills add layerai/skills) for users to manually install missing dependencies. This refers to the vendor's own repository and requires explicit user action. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided text for rendering and image editing. 1. Ingestion points: Replacement strings and render text inputs in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: Deterministic file operations (
render_text,compose_image) and image editing models. 4. Sanitization: Not specified. The threat is considered low/safe because the primary rendering tools are deterministic and not model-based.
Audit Metadata