ios-icon-gen
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local scripts (
generate_icons.swiftandiconify_gen.sh) and standard system utilities such assipsfor image conversion andpython3for JSON parsing and URL encoding. These operations are restricted to the local environment and are standard for asset generation tasks. - [EXTERNAL_DOWNLOADS]: Fetches icon assets from the Iconify API (
api.iconify.design). The downloads are limited to SVG and JSON data used for icon generation and searching, which is consistent with the skill's stated purpose and targets a well-known public service. - [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided search queries to browse icon collections. The input is sanitized via URL encoding using
urllib.parse.quotebefore inclusion in API requests, and the resulting data is used solely for asset identification and generation.
Audit Metadata