logo-design

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides structured instructions for creating high-quality, professional SVG graphics. It covers domain-specific metaphors, geometric construction, and accessibility standards without requesting excessive permissions or performing suspicious operations.
  • [INDIRECT_PROMPT_INJECTION]: The skill implements a local preview workflow where user-supplied design concepts are processed by an HTML scaffold (preview.html).
  • Ingestion points: preview.html dynamically loads and renders content from variants.js, a file the agent generates based on the user's design project.
  • Boundary markers: The project data is stored in a structured JavaScript object (window.VARIANTS) within the variants.js file.
  • Capability inventory: The agent uses standard shell commands like cp to set up the preview environment and open/xdg-open to display results to the user.
  • Sanitization: The preview.html tool includes a dedicated esc() function that performs HTML entity escaping using a temporary DOM element, ensuring that project names and descriptions are safely rendered.
  • [DYNAMIC_EXECUTION]: The preview.html asset uses a script injection pattern to implement a live-reload feature for the local variants.js file. This mechanism is restricted to the local development environment and is used to update the UI as the agent designs new logo variants.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 09:26 PM
Security Audit — agent-trust-hub — logo-design