lov-business-card
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/render_card.pyusessubprocess.runto call external binaries like Google Chrome/Chromium and the macOSsipstool. These calls are securely implemented using argument lists rather than shell strings, which effectively prevents command injection vulnerabilities. - [DATA_EXFILTRATION]: The skill includes a feature that reads a local image file provided by the user via the
--avatarflag to include a portrait on the card. This file access is limited to the user-specified path and is performed locally without any external data transmission. - [PROMPT_INJECTION]: To mitigate risks associated with processing user-supplied text (such as names and taglines), the script uses
html.escape()to sanitize all inputs before they are interpolated into the HTML template. This prevents potential indirect prompt injection attacks from breaking the design or executing unauthorized scripts in the browser context.
Audit Metadata