illustration-ink-sketch
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/render.mjsfile useschild_process.execSyncto runnpm root -gto locate the global Node.js modules path for dependency resolution. - [DYNAMIC_EXECUTION]: The
scripts/render.mjsfile uses dynamicimport()to load the Playwright library and launches a headless Chromium browser for rendering tasks. - [INDIRECT_PROMPT_INJECTION]: The skill processes SVG data which could potentially contain malicious payloads; however, the
scripts/lint.mjsutility provides a mitigation by checking for forbidden elements like<script>,<foreignObject>, and external references. - [SAFE]: File system operations are limited to reading and writing illustration-related files such as SVG, JSON, and PNG within the local workspace, and the skill includes security controls to validate generated content.
Audit Metadata