guizang-social-card-skill

Pass

Audited by Gen Agent Trust Hub on Nov 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches assets from well-known and trusted providers to enhance output quality.
  • Downloads font files from the official Google Fonts repository on GitHub via scripts/gz-fonts.mjs.
  • References and downloads images from established stock services including Unsplash, Pexels, and Flickr for use as background atmosphere or evidence layers.
  • [COMMAND_EXECUTION]: The skill relies on several local system utilities to perform its primary media processing tasks.
  • Uses ffmpeg and ffprobe for video duration detection, frame extraction, and collage rendering in scripts/make-video-contact-sheet.py and references/live-photo-production.md.
  • Invokes the swift compiler to execute metadata helper scripts (add-livephoto-maker-note.swift, add-livephoto-mov-metadata.swift) for Apple-specific Live Photo compatibility.
  • Utilizes uvx to run the makelive Python package for packaging Live Photo bundles.
  • [DYNAMIC_EXECUTION]: The skill implements a dynamic rendering pipeline to convert HTML/CSS templates into final PNG assets.
  • scripts/render.mjs generates temporary HTML files and uses Playwright (headless Chromium) to render them.
  • scripts/gz-fonts.mjs dynamically generates and inlines CSS @font-face rules using Base64-encoded font subsets at runtime.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 1, 2026, 02:03 AM