ios-app-icon-generator
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (such as the app name and description) to generate functional HTML/JavaScript artifacts. This represents a potential injection surface if a user provides malicious input that is interpolated into the generated files without sanitization.
- Ingestion points: User-supplied information regarding app purpose, name, and brand colors.
- Boundary markers: None present in the instructions.
- Capability inventory: The skill is designed to output self-contained HTML files with embedded JavaScript.
- Sanitization: There are no explicit instructions for the agent to sanitize or escape user-provided strings before including them in the HTML/JS generation.
- [DYNAMIC_EXECUTION]: The skill involves the generation of JavaScript code within a local HTML artifact to facilitate client-side image conversion. This is a low-risk, standard implementation for the skill's creative purpose.
- Evidence: The HTML artifact structure in SKILL.md includes a template for JavaScript-based SVG-to-PNG download logic.
Audit Metadata