brand-asset-sourcing
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill retrieves brand logo assets (SVGs and PNGs) from external GitHub repositories (
Jxck-S/soaring-symbolsandJxck-S/airline-logos) using standard tools likecurl. These sources are used to populate the project's logo directory. - [INDIRECT_PROMPT_INJECTION]: The skill processes brand name strings extracted from project data, representing an attack surface where maliciously crafted strings could influence agent behavior during processing.
- Ingestion points: Brand identifiers and carrier names extracted from data or code files within the project.
- Boundary markers: No specific delimiters are used to isolate extracted brand strings from the agent's instructions.
- Capability inventory: Network access via
curlfor fetching assets and file system access for writing files and manifests to the repository. - Sanitization: The procedure includes an explicit requirement to validate SVG XML and inspect for embedded scripts or styles to mitigate potential security risks from third-party assets.
Audit Metadata