skills/melvynx/aiblueprint/app-icon/Gen Agent Trust Hub

app-icon

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands using local system utilities sips (built-in macOS tool) and magick (ImageMagick) to perform image resizing, cropping, and padding. It also triggers native app builds using npx expo run to verify icon changes in a development environment.\n- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation and use of the api2cli tool and its gemini bundle via npx. These tools are authored by the same vendor as the skill and are used to interface with AI models for image generation.\n- [INDIRECT_PROMPT_INJECTION]: The skill extracts app concepts and branding information from local project configuration and documentation files to populate image generation prompts.\n
  • Ingestion points: app.json, app.config.js, app.config.ts, and project README.md files.\n
  • Boundary markers: The skill uses a structured template (<icon_recipe>) with specific placeholders for the extracted content, which helps maintain instructional context.\n
  • Capability inventory: The skill can execute shell commands (sips, magick, npx) and initiate network-based image generation.\n
  • Sanitization: The skill does not explicitly mention sanitization or validation of the brand strings extracted from the project files before they are inserted into the prompt.\n- [CREDENTIALS_UNSAFE]: The instructions include a step for tool authentication using a Google API key. This is handled via a manual CLI command with a clear placeholder (<GOOGLE_API_KEY>), which is a standard procedure for configuring development tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 08:30 PM