Skills
Navigate
skills/terminalskills/skills/opentype-js/Gen Agent Trust Hub

opentype-js

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install opentype.js from the npm registry, which is a well-known and trusted library for font processing operations.\n- [INDIRECT_PROMPT_INJECTION]: The skill exposes an interface for reading font files and writing subsetted fonts to the file system, creating an attack surface for data processing.\n
  • Ingestion points: External data enters the skill via the outputPath and chars parameters in the subsetFont function defined in SKILL.md.\n
  • Boundary markers: The code examples do not specify delimitation strategies or instructions to ignore embedded prompts within font data or paths.\n
  • Capability inventory: The skill uses fs.writeFileSync to write data to the local file system based on the provided parameters.\n
  • Sanitization: The implementation examples do not demonstrate explicit path sanitization or validation, which is typical for a library usage guide but creates a surface for potential misuse if handled by an autonomous agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 08:50 AM