sqsl-style-cloner
Warn
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The asset script
assets/style_olive_artisan.pyusessubprocess.runto execute a headless Google Chrome instance for capturing screenshots of rendered HTML components. This involves executing an external binary with user-influenced parameters. - [DYNAMIC_EXECUTION]: The skill generates new Python source files (
.py) at runtime by interpolating extracted visual data into a template (templates/style_template.py). These generated scripts are intended for subsequent execution by the parent typesetting engine. - [EXTERNAL_DOWNLOADS]:
scripts/clone_wechat_style.pyfetches article content from arbitrary URLs usingurllib.request.urlopen. While the primary use case targets WeChat articles, the code does not strictly restrict the domains it can access. - [PERSISTENCE]: The skill is configured to write generated Python style modules into the user's home directory at
~/.gemini/config/skills/sqsl-article-to-wechat/styles. Writing executable code to persistent configuration paths outside the skill's own directory is a notable behavior. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill ingests untrusted HTML and CSS data from external URLs provided by the user.
- Boundary markers: None identified in the parsing logic to distinguish between data and instructions.
- Capability inventory: File writing (Python modules), Network access (fetching URLs), and Subprocess execution (rendering via Chrome).
- Sanitization: Includes basic regex-based validation for colors and slugs, but relies on these to drive code generation and visual rendering steps.
Audit Metadata