handdraw-good-deed-story
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The orchestration script
one_click.pyutilizessubprocess.runto call local scripts and external rendering tools likehyperframes. These calls are implemented using argument lists rather than shell strings, mitigating command injection risks. - [EXTERNAL_DOWNLOADS]: The skill connects to user-defined AI endpoints to fetch story data and images. It also requires common external libraries like GSAP and HyperFrames, which is consistent with its purpose of media automation.
- [CREDENTIALS_UNSAFE]: The project follows standard security practices by instructing users to store API keys in environment variables. The codebase does not contain hardcoded secrets or insecure storage mechanisms.
- [DATA_EXFILTRATION]: Network communication is restricted to the specific API providers and endpoints configured by the user. No unauthorized data transmission or exfiltration behavior was detected.
Audit Metadata