dev-app-assets
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses local system utilities (sips) and a platform-specific CLI (gen-ai) for its intended purpose of image processing and generation. No unauthorized network activity, credential harvesting, or data exfiltration attempts were detected.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text, such as app names and style directions, which is interpolated into shell commands for image generation. This creates an attack surface where malformed user input could potentially influence command execution.
- Ingestion points: User-supplied application details and visual style preferences defined in the Prerequisites section (SKILL.md).
- Boundary markers: The skill examples use standard shell quoting for parameter interpolation but do not include explicit instructions for input validation.
- Capability inventory: Access to image generation tools (gen-ai) and local file system utilities (sips) for file creation and modification.
- Sanitization: No explicit sanitization or validation logic is defined within the skill instructions.
Audit Metadata