lov-normalize-tauri-app-icon
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external project files and image assets, which presents a potential surface for indirect prompt injection if the agent is directed to work on untrusted repositories.\n
- Ingestion points: The agent is instructed to locate and read
src-tauri/tauri.conf.json,src-tauri/build.rs, and icon source files from the active Tauri project directory as described in Step 0 of the workflow.\n - Boundary markers: Instructions do not explicitly define delimiters or specific safety warnings for the agent when reading and interpreting these project configuration files.\n
- Capability inventory: The skill includes Python scripts capable of writing to the file system, specifically for generating normalized icons via
scripts/tauri_app_icon.pyand updating user profile data viascripts/profile_store.py.\n - Sanitization: Image content processing is handled by the
Pillowlibrary, and project file verification is limited to checking for specific build script declarations and performing SHA-256 hash comparisons.\n- [EXTERNAL_DOWNLOADS]: The skill refers to standard, well-known Python packages (Pillow,PyYAML) and the official Tauri CLI. These are established development dependencies and do not pose a security risk.\n- [COMMAND_EXECUTION]: The skill provides scripts for executing local build and image manipulation tasks. These operations are scoped to the project's local environment and follow documented Tauri development patterns.
Audit Metadata