draw-your-font
Warn
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the npx utility to download the draw-your-font@0.1.0 package from the NPM registry at runtime.
- [REMOTE_CODE_EXECUTION]: The skill executes external code by fetching and running a third-party NPM package, which is not part of the trusted vendor list.
- [COMMAND_EXECUTION]: The skill performs multiple shell command executions locally using npx to process images and generate font files, incorporating user-provided parameters.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from handwriting photos and user-defined character mappings to generate font files via shell commands. There are no sanitization measures or boundary markers described to prevent malicious input from affecting the command execution. Ingestion points: User-provided images and character labels. Boundary markers: Absent. Capability inventory: Local command execution via npx and file system writes. Sanitization: Absent.
Audit Metadata