psd-to-cocos
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The conversion logic relies on executing external Python scripts (
psd_layers.pyandexport_slices.py) from dependent skills usingsubprocess.run. The implementation uses argument lists rather than shell strings, effectively preventing shell injection vulnerabilities. These tools are resolved from restricted local directories such as.claude/skillsor via a specific environment variable. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied file paths and extracts metadata (such as layer names) from PSD files. It mitigates risks by normalizing and sanitizing these inputs—specifically converting non-Latin characters to Pinyin and stripping special characters—before using them for directory creation or as identifiers in the generated JSON layout files.
Audit Metadata