icon-set-generator
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides two Python scripts,
validate_icons.pyandbuild_preview.py, which are executed locally to process icon files. These scripts do not perform network requests or access sensitive files. - [SAFE]: No malicious patterns such as prompt injection, data exfiltration, or obfuscation were detected. The skill follows best practices by using standard library components and local execution.
- [INDIRECT_PROMPT_INJECTION]: The skill has a surface for processing untrusted data. 1. Ingestion points: The scripts read SVG files and
style-spec.jsonfrom the user-providedicons/directory. 2. Boundary markers: Absent; the scripts process all files in the directory without specific boundary delimiters. 3. Capability inventory: The scripts are capable of reading and writing files within the project directory (build_preview.pywrites an HTML file). 4. Sanitization:build_preview.pyuseshtml.escapeto sanitize input values before including them in the HTML output.
Audit Metadata