logo-mask-reveal
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install several legitimate third-party Python libraries (
svgelements,svgpathtools,numpy,pillow) usingpip. These are standard packages for vector and image processing. - [COMMAND_EXECUTION]: The skill executes a locally provided Python script (
build_reveal.py) to process SVG files and generate animation command batches. This is a core part of its functionality and does not involve arbitrary or untrusted command execution. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided SVG files, which constitutes an attack surface.
- Ingestion points: User-provided SVG files are read from
/workspace/.eve/attachments/or local folders. - Boundary markers: None specific to the SVG data.
- Capability inventory: Uses
python3to run the internal build script andcurl -Tto upload preview images to the Tella platform. - Sanitization: The Python script uses dedicated parsing libraries (
svgelements,svgpathtools) to handle SVG structure rather than raw shell interpolation, reducing the risk of injection attacks.
Audit Metadata