cola-avatar-pack
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands for environment validation, directory management, and executing its image processing logic. It incorporates explicit sanitization steps, such as filtering shell metacharacters and validating user-provided inputs via regular expressions, to prevent command injection.- [EXTERNAL_DOWNLOADS]: The skill may install widely-used Python packages like 'Pillow' and 'rembg' from official registries to support its image processing features.- [REMOTE_CODE_EXECUTION]: A Python script invokes the 'rembg' utility using
subprocess.run. The implementation follows security best practices by passing arguments as a list and managing file paths through secure temporary file creation.- [SAFE]: The skill operates within a restricted local workspace (~/.cola/avatar/) and performs security checks, such as verifying that directories are not symbolic links before deletion, to ensure system integrity.
Audit Metadata