office-quotes
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches quotes and SVG assets from
officeapi.akashrajpurohit.com. This is a well-known public API for this specific purpose and is documented in the skill's source code and metadata. - [COMMAND_EXECUTION]: The
office-quotes.jsscript uses Playwright to launch a Chromium browser instance for rendering SVG to PNG. While this involves sub-process execution, it is scoped to rendering local HTML wrappers of the fetched SVG content and does not process arbitrary user input. - [EXTERNAL_DOWNLOADS]: The skill's metadata suggests installing the
office-quotes-clipackage via npm. This is the expected distribution method for the tool described. - [SAFE]: Python scripts (
svg2png.pyandsvg2png_file.py) perform local image processing using standard libraries (urllib, PIL, xml.etree) without any dangerous network or file system operations beyond their stated purpose.
Audit Metadata