editorial-dot-cover
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a Python script (scripts/render_cover.py) to handle image generation logic. This script further calls external binaries like Chromium or rsvg-convert via subprocess.run to render SVG files into PNG format. These calls use the list-of-arguments form, which is a standard and secure method for executing external processes without shell exposure.
- [SAFE]: Robust input sanitization is implemented in the rendering script. All user-controlled strings, including the cover label, title, and font specifications, are passed through html.escape() before being embedded into the generated SVG. This prevents injection attacks (such as SVG-based XSS or XXE) that could otherwise be triggered by malicious user input.
Audit Metadata