glyph-design

Pass

Audited by Gen Agent Trust Hub on Aug 23, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/render_contactsheet.py utility uses subprocess.run to invoke the macOS system tool qlmanage. This function converts SVG files into PNG format to generate a contact sheet for visual inspection. The command is constructed using a list of arguments without invoking a shell, which mitigates the risk of shell injection attacks through manipulated file names.
  • [EXTERNAL_DOWNLOADS]: The skill requires the Pillow Python library for image composition and processing. The instructions recommend installing it via the standard package manager (pip3 install --user pillow). Pillow is a well-known, trusted, and widely-used library for image manipulation in the Python ecosystem.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: No network activity, hardcoded credentials, or access to sensitive system files (such as SSH keys or environment variables) was detected. The script's operations are confined to reading SVG files from user-specified directories and writing the resulting image to a local path.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 23, 2026, 06:03 AM
Security Audit — agent-trust-hub — glyph-design