create-theme
Warn
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download community theme data by cloning an external GitHub repository (
github.com/mbadolato/iTerm2-Color-Schemes). - [REMOTE_CODE_EXECUTION]: The documentation directs the user or agent to execute a shell script (
generate-schemes.sh) located within the cloned third-party repository to process downloaded assets. - [COMMAND_EXECUTION]: The skill includes shell commands for repository cloning and script execution to automate theme management tasks.
- [INDIRECT_PROMPT_INJECTION]: The skill processes theme configuration files and allows loading external Glamour JSON style definitions, creating an attack surface for malicious configuration data.
- Ingestion points: The
markdownThemefield inconfig.jsoncan be configured to point to a local file path for JSON styles. - Boundary markers: There are no explicit instructions to validate the content of external JSON files before loading.
- Capability inventory: The skill facilitates file writing for configuration and shell command execution for theme generation.
- Sanitization: While hex color formats are validated, there is no documented sanitization for the logic or structure of external Glamour style files.
Audit Metadata