qr-code-builder
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFE
Full Analysis
- Path Traversal Prevention: The skill implements a strict 'scratch' folder policy, ensuring that all generated files are written into a new, isolated directory. The bundled Python script includes checks to verify that file operations do not escape the designated working directory using techniques like '..' segments.
- Input Sanitization and Quoting: The skill instructions provide specific guidance for the agent to avoid command injection by using argument lists for subprocesses or implementing rigid shell-quoting patterns for all user-supplied values, such as URLs and captions.
- Secure Image Processing: When processing SVG logos, the script includes a custom fetcher and validation logic to prevent XML External Entity (XXE) attacks and blocks the loading of external resources or network-based assets, which is a significant security best practice for handling untrusted files.
- Controlled Dependency Discovery: The use of dynamic imports (e.g.,
__import__) is restricted to a predefined list of trusted library names to check for the presence of optional dependencies (like QR scanners or encoders), posing no risk of unauthorized code execution. - Safe Bulk Processing: The spreadsheet conversion and CSV parsing logic are designed to handle data as literal text, reducing the surface area for injection when processing user-uploaded files.
Audit Metadata