google-fonts
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: Maintenance scripts fetch font metadata from the official Google Fonts GitHub repository (google/fonts) to keep the internal font library up to date.
- [EXTERNAL_DOWNLOADS]: The project uses the Replicate API (api.replicate.com) via an image generation script to produce Open Graph preview images for the project's showcase gallery.
- [SAFE]: The skill provides thorough sanitization for generated CSS, JavaScript, and HTML embed code. It utilizes dedicated helper functions to escape font names and other user-controllable strings, effectively mitigating the risk of injection vulnerabilities in downstream web projects.
- [SAFE]: Secret management follows best practices, using environment variables for API tokens required by internal scripts rather than hardcoding credentials.
Audit Metadata