live-panel
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes a helper script
scripts/fetch_fonts.shthat downloads a specific font file (Xiaolai-Regular.ttf) from a public GitHub repository (github.com/lxgw/kose-font). This is used to provide handwriting-style text in the 'excalidraw' diagram theme. - [COMMAND_EXECUTION]: The skill executes local system commands to perform rendering and validation:
scripts/livepanel.pylaunches Chrome/Chromium in headless mode using a DevTools pipe for high-fidelity screenshots.scripts/render.pyandscripts/check_frames.pyexecute FFmpeg to encode images into MP4 files and extract frames for comparison.scripts/verify_view.pyexecutes internal scripts for automated testing.- All subprocess calls use list-based arguments, which is a safe practice to prevent command injection.
- [INDIRECT_PROMPT_INJECTION]: The skill exposes an ingestion surface by processing JSON configuration files (
config.json). This configuration is interpolated into an HTML template for rendering. The skill mitigates potential script injection risks by escaping the</tag sequence when stringifying the JSON into the HTML page context.
Audit Metadata