app-icon-gen
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements strong security practices for its stated purpose.
- [DATA_EXPOSURE]: The scripts include dedicated functions (
safeRelativeOutputPathandassertNoSymlinkAncestors) to prevent directory traversal and ensure all file operations stay within the user-defined delivery directory. It also performs recursive symlink checks. - [COMMAND_EXECUTION]: Execution of external binaries is restricted to a specific Apple utility (
ictool) on macOS and internal Node.js scripts. Command arguments are sanitized using strict alphanumeric filters (e.g., theupperCamelfunction) to prevent injection. - [REMOTE_CODE_EXECUTION]: SVG processing includes validation that explicitly bans dangerous tags such as
<script>,<foreignObject>, and<image>, as well as attributes containing external URLs, preventing cross-site scripting or data exfiltration via SVG files. - [EXTERNAL_DOWNLOADS]: Dependencies are limited to standard, well-known libraries from the official NPM registry (e.g., resvg-js, pngjs).
Audit Metadata