lov-find-logo
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches brand assets from Clearbit's logo API, Google's favicon service, and official brand URLs requested by the user.\n- [COMMAND_EXECUTION]: Executes the local Python script
scripts/find_logo.pyto handle networking, image format analysis, and local file storage.\n- [PROMPT_INJECTION]: The skill ingests untrusted HTML content from external websites to extract image metadata, which represents a surface for indirect prompt injection.\n - Ingestion points:
scripts/find_logo.py(within thescrape_page_imagesfunction).\n - Boundary markers: None; the script extracts URLs directly from HTML attributes.\n
- Capability inventory: The script has the ability to perform network requests and write files to the local disk.\n
- Sanitization: Uses standard library
html.parserfor extraction; it does not implement specific filtering for instructions in the extracted metadata.
Audit Metadata