animating-icons
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The verification scripts (
verify-icon.mjs) download and install theplaywrightpackage from the NPM registry. This package is used for automated browser testing and is stored in a local cache directory at~/.cache/animating-icons-verify. - [COMMAND_EXECUTION]: The skill executes shell commands via
child_process.spawnSyncto manage dependencies (npm install), perform automated browser testing (npx playwright), and process images (ffmpeg). These are standard operations for the skill's stated purpose of icon verification. - [COMMAND_EXECUTION]: The skill dynamically generates temporary JavaScript runner files (e.g.,
_verify-runner.cjs) and executes them using thenodeprocess to facilitate automated icon verification. These scripts are generated from fixed internal templates and do not incorporate untrusted external input.
Audit Metadata