visual-assets
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest external data, including a project-wide truth file (
.agents/marketing-context.md) and user-provided source materials. While this creates an attack surface for indirect prompt injection, the skill includes explicit defensive instructions to 'remove private data, secrets, unrelated accounts, notifications, and unstable timestamps' when preparing product screenshots, which significantly mitigates risk. - [COMMAND_EXECUTION]: The instructions reference the use of common local command-line tools for image optimization, such as
ImageMagick,cwebp, andavifenc. These are standard tools for the described tasks, and the skill advises verifying installed versions and comparing output visually, which follows standard development best practices.
Audit Metadata