icon-critique
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script "scripts/render_icon.py" executes system utilities such as rsvg-convert, inkscape, or ImageMagick to process SVG files. These tools are invoked via "subprocess.run" using a list of arguments without a shell, which prevents command injection vulnerabilities. Additionally, the skill workflow includes a mandatory security linting step via "check_svg.py" to sanitize SVG files of malicious elements like scripts or external references before they are rendered.
Audit Metadata