illustration-ink-sketch

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/render.mjs file uses child_process.execSync to run npm root -g to locate the global Node.js modules path for dependency resolution.
  • [DYNAMIC_EXECUTION]: The scripts/render.mjs file uses dynamic import() to load the Playwright library and launches a headless Chromium browser for rendering tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes SVG data which could potentially contain malicious payloads; however, the scripts/lint.mjs utility provides a mitigation by checking for forbidden elements like <script>, <foreignObject>, and external references.
  • [SAFE]: File system operations are limited to reading and writing illustration-related files such as SVG, JSON, and PNG within the local workspace, and the skill includes security controls to validate generated content.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 12:14 PM