design-deck
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the user/agent to use shell commands for file management (
mkdir,cp) and serving content locally (python3 -m http.server). These are standard development tasks within the skill's stated scope. - [REMOTE_CODE_EXECUTION]: The skill uses
uv runto execute a local Python script (scripts/dither.py). This is a local execution pattern for a utility provided within the skill package. - [DYNAMIC_EXECUTION]: The
dither.pyscript uses the Python Imaging Library (Pillow) to process images. It does not useeval(),exec(), or perform any unsafe deserialization. - [DATA_EXFILTRATION]: No network operations or sensitive file access patterns were found. The local HTTP server is used for rendering masks that are blocked by browser security policies on
file://origins. - [OBFUSCATION]: No obfuscated code, hidden URLs, or suspicious character encoding were detected in the scripts or assets.
Audit Metadata