brand-icons
Fail
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: CRITICALCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/find-icon.shis vulnerable to a Python injection attack. User-provided search keywords are directly interpolated into a Python command string (kw='''$kw_lc''') without sanitization. An attacker can provide a crafted keyword containing triple quotes to escape the string context and execute unauthorized Python commands on the system.\n- [REMOTE_CODE_EXECUTION]: The skill's scripts download JSON metadata from the jsDelivr CDN and process it usingpython3. While jsDelivr is a well-known service, the pattern of piping network-retrieved content directly into an interpreter is a significant security risk.\n- [EXTERNAL_DOWNLOADS]: The skill fetches brand logo SVG files and package metadata fromdata.jsdelivr.comandcdn.jsdelivr.net. These are well-known and established public CDN services.
Recommendations
- HIGH: Downloads and executes remote code from: https://data.jsdelivr.com/v1/packages/npm/@lobehub/icons-static-svg/resolved, https://data.jsdelivr.com/v1/packages/npm/@lobehub/icons-static-svg@${ver}?structure=flat - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata