ascii-art
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches data from several external services including
asciified.thelicato.io,ascii.co.uk,api.github.com,qrenco.de, andwttr.in. These are used to retrieve ASCII art text or static HTML content and do not involve downloading executable binaries or scripts. - [COMMAND_EXECUTION]: The skill provides instructions for installing common utility packages (
pyfiglet,cowsay,boxes,toilet,jp2a,ascii-image-converter) using standard package managers likeapt,brew,pip, andsnap. These are legitimate tools for the skill's stated purpose. - [REMOTE_CODE_EXECUTION]: The automated alert regarding
https://ascii.co.uk/art/catis a false positive. The skill usescurlto download a static HTML page to a temporary file and then uses a Python regex snippet to extract text within<pre>tags. The content is never executed as code; it is processed as data to be displayed to the user.
Audit Metadata