rocaille-shader
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a Python script (
scripts/rocaille_generator.py) to generate shader code and HTML demos based on user-defined parameters. - [INDIRECT_PROMPT_INJECTION]: The generator script ingests local file paths for logo processing through the
--inputargument. Analysis of the script confirms it usesargparsefor type validation and performs simple base64 encoding of the file content for HTML embedding, preventing the data from being interpreted as instructions. - Ingestion points: The
--inputargument inscripts/rocaille_generator.pyand thelogoquery parameter inassets/templates/liquid-logo.html. - Boundary markers: The Python script enforces argument types (int, float, choices) using
argparse. - Capability inventory: The skill performs local file reads and writes via the Python generator script.
- Sanitization: Path existence checks are performed before reading, and content is base64 encoded for safe interpolation into HTML templates.
- [SAFE]: The skill includes documentation and references to well-known graphics techniques and community libraries (e.g., Shadertoy, Three.js) which are presented neutrally for developer reference.
Audit Metadata