logo-designer-skill
Warn
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill is a stub designed to install the full
logo-designerskill from a third-party GitHub repository (https://github.com/neonwatty/logo-designer-skill) using thenpx skills addcommand. This represents a supply-chain risk as the external repository is not associated with a trusted vendor. - [INDIRECT_PROMPT_INJECTION]: The skill's primary functionality involves a 'brand interview' that ingests untrusted user input to generate SVG logo concepts and perform PNG exports. This creates a surface where malicious input could influence the generated code or the execution of downstream conversion tools.
- Ingestion points: Brand interview responses captured from the user during the design process.
- Boundary markers: Absent; the instructions do not specify any delimiters or 'ignore embedded instructions' warnings for the brand data.
- Capability inventory: File system access for writing SVGs and PNGs, and execution of external conversion utilities like
resvg,Inkscape, orlibrsvg. - Sanitization: None; the stub lacks logic for sanitizing or validating user-provided brand descriptions before they are used in design generation.
Audit Metadata