app-icon-template-creator
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill runs a provided Node.js linting script (
template_lint.mjs) to verify the integrity and format of the created templates.\n- [EXTERNAL_DOWNLOADS]: The skill downloads theajvlibrary from the official NPM registry, a well-known service, to perform JSON schema validation.\n- [PROMPT_INJECTION]: The workflow creates an indirect prompt injection surface by analyzing untrusted user-provided icon references to construct prompts for other AI tools.\n - Ingestion points: User-supplied reference images, SVGs, and screenshots via the
<delivery>folder.\n - Boundary markers: Defined in
SKILL.md(Hard Contract) andreferences/reference-analysis-protocol.md(Drift Guards) to prevent brand copying and maintain design language.\n - Capability inventory: File system operations for reconstruction and migration artifacts, image generation tool execution, and local script execution.\n
- Sanitization: Verification gates for reconstruction and migration steps, followed by an automated linting step using JSON schema validation.
Audit Metadata