appstore-assets

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads caption fonts and their associated licenses from Google Fonts (googleapis.com) and Google's official GitHub repository (github.com/google/fonts). These are trusted, well-known services used for standard styling purposes.
  • [COMMAND_EXECUTION]: The skill uses Python's subprocess module to invoke headless Chrome/Chromium for rendering HTML templates into high-resolution PNG assets. It also utilizes standard Git commands for repository synchronization (fetch, rebase, stash) to ensure the asset set is written to a clean state. These operations are essential to the skill's primary function.
  • [INDIRECT_PROMPT_INJECTION]: As the skill processes untrusted input from external codebases and landing pages, it includes dedicated subagent instructions (app-explorer) designed to cite specific evidence (file paths or quoted text) for every claim. This grounded approach prevents the agent from being misled by adversarial content within the analyzed project.
  • [DYNAMIC_EXECUTION]: The skill generates a local configuration file (config.js) from its internal templates to drive the browser-based rendering process. This is a low-risk, standard template-to-script generation pattern used to facilitate the marketing asset pipeline.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 03:33 PM