featured-image-creator
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: Uses the rsvg-convert command-line utility to convert generated SVG files into PNG format.
- [INDIRECT_PROMPT_INJECTION]: Ingests and processes SVG data from local directories (~/Icons/ and ~/Downloads/). While the skill instructions specify extracting specific XML components (paths, styles), reading external data into the agent's context presents a surface for indirect prompt injection if those files contain malicious instructions.
- Ingestion points: Local SVG files in ~/Icons/ and ~/Downloads/ (SKILL.md).
- Boundary markers: Not explicitly defined for the processed content.
- Capability inventory: Shell execution of rsvg-convert (SKILL.md).
- Sanitization: No explicit sanitization of the extracted SVG path or style data.
Audit Metadata