Skills
Navigate
skills/yschimke/skills/compose-preview-design-board/Gen Agent Trust Hub

compose-preview-design-board

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The documentation in SKILL.md includes an installation command that fetches a script from https://raw.githubusercontent.com/yschimke/skills/main/scripts/install.sh and pipes it directly to bash. This pattern is used to install the required CLI tools and is directed at the author's own repository.
  • [COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands, specifically compose-preview to render images and python3 scripts/build-design-board.py to assemble the final design board artifact.
  • [INDIRECT_PROMPT_INJECTION]: The Python script scripts/build-design-board.py processes external JSON specifications which could potentially contain malicious instructions. The script follows security best practices by using html.escape() to sanitize all text fields (captions, notes, titles, etc.) before embedding them into the generated HTML file, preventing potential XSS or injection when the board is viewed.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 11:04 AM