rocaille-shader

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a Python script (scripts/rocaille_generator.py) to generate shader code and HTML demos based on user-defined parameters.
  • [INDIRECT_PROMPT_INJECTION]: The generator script ingests local file paths for logo processing through the --input argument. Analysis of the script confirms it uses argparse for type validation and performs simple base64 encoding of the file content for HTML embedding, preventing the data from being interpreted as instructions.
  • Ingestion points: The --input argument in scripts/rocaille_generator.py and the logo query parameter in assets/templates/liquid-logo.html.
  • Boundary markers: The Python script enforces argument types (int, float, choices) using argparse.
  • Capability inventory: The skill performs local file reads and writes via the Python generator script.
  • Sanitization: Path existence checks are performed before reading, and content is base64 encoded for safe interpolation into HTML templates.
  • [SAFE]: The skill includes documentation and references to well-known graphics techniques and community libraries (e.g., Shadertoy, Three.js) which are presented neutrally for developer reference.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 10:42 AM