lov-image-creator
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
gen_image.pyautomatically executes shell commands to install missing dependencies (pip install --user) and usessubprocess.runto invoke the system viewer (open) on macOS to display results. - [EXTERNAL_DOWNLOADS]: The skill dynamically downloads and installs Python packages (
google-genai,Pillow) from PyPI if they are not present in the user's environment. While these are common libraries, the automatic installation at runtime introduces a change to the user's environment without manual confirmation. - [COMMAND_EXECUTION]: The script
scripts/render_to_png.pyuses Playwright to launch a Chromium browser and render local HTML files to PNG. While Playwright is a standard tool, it involves launching and controlling a browser process locally. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill utilizes an API key (
ZENMUX_API_KEY) for Gemini/ZenMux. While it correctly suggests using an environment variable rather than hardcoding, it instructs the agent to handle this sensitive credential.
Audit Metadata