lov-image-creator

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes browser automation through Playwright (scripts/render_to_png.py) to convert HTML designs into PNG images and executes local Python scripts to handle image generation and profile state.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-defined content, project assets, and brand data to generate image prompts, creating a surface for potential instruction injection via external data.
  • Ingestion points: Ingests data from user requests, project files, and a local profile store located in the user's home directory (~/.lovstudio/skills/profile.json).
  • Boundary markers: Instructions in SKILL.md define execution boundaries that require manual confirmation for reusable changes and emphasize reading current state before action.
  • Capability inventory: The skill can write files to the local system, perform network requests to an external image generation API (zenmux.ai), and launch a headless browser.
  • Sanitization: The scripts/profile_store.py utility includes a security filter that prevents the persistence of fields containing sensitive keywords such as token, secret, password, or api_key.
  • [EXTERNAL_DOWNLOADS]: The skill requires external libraries including google-genai, Pillow, and playwright to perform its core functions, as documented in the compatibility section of SKILL.md.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 04:00 PM