brand-logos
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches SVG logo files and raw markup from the SVGL REST API at api.svgl.app and React components from the svgl.app domain.
- [REMOTE_CODE_EXECUTION]: The skill facilitates the installation of React components from a third-party shadcn registry hosted at svgl.app using the shadcn CLI, which results in the execution and integration of external code into the local project environment.
- [COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands such as curl for downloading assets and package manager commands like pnpm dlx or npx for component installation and registry management.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from a remote API and inlines it directly into project source code, which creates a potential vulnerability surface.
- Ingestion points: SVG markup and component metadata fetched via curl and shadcn CLI from api.svgl.app (SKILL.md).
- Boundary markers: None identified.
- Capability inventory: Network access via curl, file writing via shell redirection, and component installation via package managers (SKILL.md).
- Sanitization: No explicit sanitization of remote SVG markup or registry JSON is defined.
Audit Metadata