lov-business-card
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
subprocess.runinscripts/render_card.pyto invoke Google Chrome or Chromium for headless rendering andsipsfor image cropping on macOS. These operations are performed using list-based argument arrays, which is a secure implementation that avoids shell command injection risks. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text such as names and taglines for the business card. The Python rendering script uses
html.escapeto sanitize all user inputs before they are placed into the HTML template, mitigating potential HTML injection or Cross-Site Scripting (XSS) issues in the generated output files. - [EXTERNAL_DOWNLOADS]: The skill includes a vendored third-party JavaScript library,
modern-screenshot.umd.js, in its assets folder. This library is used to provide an interactive download feature within the generated HTML file. The library is a standard tool for DOM-to-image conversion and does not show signs of malicious behavior.
Audit Metadata