svg-graphics
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches SVG icon assets from the official FontAwesome GitHub repository as specified in
SKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data for visualization and retrieves external content, creating an attack surface for indirect prompt injection.
- Ingestion points: User-provided data for chart generation and icon identifiers for remote fetching (documented in
SKILL.md). - Boundary markers: None specified; lacks explicit delimiters in
SKILL.mdto separate user data from instructions. - Capability inventory: Uses
WebFetchfor network operations and reads local files from the~/Icons/andreferences/directories (documented inSKILL.md). - Sanitization: No mention of explicit validation or sanitization for input data or retrieved SVG path content in
SKILL.md.
Audit Metadata