glyph-design
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/render_contactsheet.pyutility usessubprocess.runto invoke the macOS system toolqlmanage. This function converts SVG files into PNG format to generate a contact sheet for visual inspection. The command is constructed using a list of arguments without invoking a shell, which mitigates the risk of shell injection attacks through manipulated file names. - [EXTERNAL_DOWNLOADS]: The skill requires the
PillowPython library for image composition and processing. The instructions recommend installing it via the standard package manager (pip3 install --user pillow). Pillow is a well-known, trusted, and widely-used library for image manipulation in the Python ecosystem. - [DATA_EXPOSURE_AND_EXFILTRATION]: No network activity, hardcoded credentials, or access to sensitive system files (such as SSH keys or environment variables) was detected. The script's operations are confined to reading SVG files from user-specified directories and writing the resulting image to a local path.
Audit Metadata