throngterm-sprite
Pass
Audited by Gen Agent Trust Hub on Mar 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
generate-logo-pack.jsexecutes a hardcoded Python script viaspawnSyncto handle background transparency. This execution is a primary function of the skill and utilizes safe argument passing methods to interact with the Python interpreter. - [EXTERNAL_DOWNLOADS]: The skill requires the Python
Pillowlibrary for raster image processing. The tool provides clear instructions to the user to install this dependency using standard package managers if it is not already present. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface in
generate-logo-pack.js. 1. Ingestion points: The--nameCLI argument is interpolated into SVG<title>andaria-labelattributes. 2. Boundary markers: Absent. 3. Capability inventory: The skill writes SVG files to the local.throngterm/spritesdirectory. 4. Sanitization: Absent. Malicious input provided to the name argument could be used to inject attributes into the resulting SVG metadata.
Audit Metadata