svg-logo-system
Pass
Audited by Gen Agent Trust Hub on Mar 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local shell commands to perform bulk edits on generated assets. Specifically, it uses
sedto find and replace color values across multiple SVG files in thetinker/directory. - [COMMAND_EXECUTION]: It attempts to use common image processing utilities
rsvg-convert(from librsvg) andmagick(ImageMagick) to generate favicons and PNG exports from SVG source files. - [EXTERNAL_DOWNLOADS]: The skill provides textual instructions for the user to install third-party dependencies (
librsvg,imagemagick) via standard package managers like Homebrew if the tools are not detected on the system. - [PROMPT_INJECTION]: The skill implements an automated context extraction phase (Phase 0) that reads existing project files such as
CLAUDE.md,tailwind.config.js, and Laravel Blade templates. This represents an indirect prompt injection surface where content in those files could theoretically influence the agent's behavior, although no exploitable pattern was found.
Audit Metadata