instagram-tweet-carousel
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements security best practices by instructing the agent to use Python for file operations instead of shell scripts to prevent command injection during HTML generation.
- [EXTERNAL_DOWNLOADS]: The skill installs the Playwright package and Chromium browser via standard package managers (pip) to facilitate image export. It also fetches the Inter font from Google Fonts' official CDN.
- [DATA_EXFILTRATION]: No evidence of sensitive data harvesting or exfiltration was found. File access is restricted to the current working directory and the skill's own assets folder for profile photo lookup.
- [COMMAND_EXECUTION]: Local command execution is limited to standard environment checks (file format identification) and the execution of generated Python scripts for rendering images.
Audit Metadata