animated-readme-logo
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements strong security boundaries for repository operations. The audit script (
audit-readme-logo-assets.mjs) explicitly enforces root-bounded path resolution, rejecting absolute paths, UNC paths, and symlink-escaping traversals to prevent accidental file system exposure. - [SAFE]: Asset validation is performed locally using bundled scripts.
validate_logo_svg.pystrictly filters SVG content for dangerous elements (e.g.,<script>,<foreignObject>, external references, and CSS animation) to ensure compatibility with GitHub's rendering environment. - [SAFE]: The skill uses an 'assume-unavailable' approach for external tools like Recraft. It requires explicit user approval and a live cost preflight before making any credit-consuming calls, and falls back to local SVG generation if provider state is indeterminate.
- [SAFE]: Raster image inspection (
inspect-animated-image.mjs) validates the structural integrity of GIF, APNG, and WebP files while stripping hidden metadata (EXIF, XMP, ICC profiles) and ensuring frame limits are respected.
Audit Metadata