generate-cover
Pass
Audited by Gen Agent Trust Hub on May 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The execution script
scripts/index.jsutilizesexecSyncto perform a silent installation of Node.js dependencies (npm i puppeteer commander) if they are not detected in the environment. - [EXTERNAL_DOWNLOADS]: During initialization, the skill downloads external code and the Puppeteer browser binaries from the NPM registry and stores them in a local cache directory (
~/.cache/gen-cover-skill). - [COMMAND_EXECUTION]: The Puppeteer browser instance is launched with the
--disable-web-securityflag, which reduces the security isolation of the browser context used for rendering the image templates.
Audit Metadata