lov-image-creator
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of several standard Python libraries, including
google-genai,Pillow, andplaywright, which are necessary for image processing and rendering functionality.\n- [COMMAND_EXECUTION]: The skill executes bundled Python scripts (gen_image.py,profile_store.py,render_to_png.py) to perform its primary tasks. These scripts are managed as internal vendor resources.\n- [DYNAMIC_EXECUTION]: Therender_to_png.pyscript utilizes the Playwright library to launch a Chromium browser instance to render HTML and SVG content into static images.\n- [PERSISTENCE]: The skill maintains a persistent user profile in a local JSON file via theprofile_store.pyscript, allowing it to remember brand assets and user preferences across different sessions.\n- [INDIRECT_PROMPT_INJECTION]: The tool processes HTML and SVG files for rendering, creating a potential surface for indirect prompt injection if those files contain malicious instructions.\n - Ingestion points: The
render_to_png.pyscript reads HTML documents from the local project workspace for rendering.\n - Boundary markers: The
SKILL.mdworkflow requires the agent to explicitly identify project files and respect project-level output directories before execution.\n - Capability inventory: The skill has the capability to perform local file system writes and execute automated browser rendering via Playwright.\n
- Sanitization: The rendering script processes HTML files directly from the local workspace without additional sanitization filters.
Audit Metadata