icon-export
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill focuses on deterministic icon rendering and asset generation.
- [COMMAND_EXECUTION]: The Python backend (scripts/export_icons.py) invokes external binaries such as rsvg-convert, magick, and inkscape using subprocess.run with list-based arguments. This approach avoids shell=True, mitigating shell injection risks. Command arguments like dimensions and paths are properly scoped.
- [PROMPT_INJECTION]: The instructions are strictly limited to the icon export workflow and do not contain attempts to subvert agent behavior or safety guardrails. Additionally, the script implements a load_master preflight check that scans for and rejects files containing active content (, javascript:), XML external entities (<!doctype, <!entity), or external resource references (http://, https://, data:), defending against indirect injection via SVGs.
- [DATA_EXFILTRATION]: No network operations or secret harvesting patterns were detected. The script performs local file reads and writes directed by user configuration.
Audit Metadata