concept-to-image
Pass
Audited by Gen Agent Trust Hub on Apr 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill performs its stated function of visual generation using standard, non-malicious patterns. All operations are confined to the local environment and intended for the user's workflow.\n- [COMMAND_EXECUTION]: The skill utilizes a local Python script to execute a headless Chromium browser via the Playwright library for rendering purposes. This is the core mechanism for exporting HTML designs to image files.\n- [EXTERNAL_DOWNLOADS]: The documentation guides users to install the Playwright library and Chromium browser engine from official, trusted registries. These are well-known developer tools.\n- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it translates user concepts into HTML content. Ingestion points: User concept prompts from SKILL.md; Boundary markers: Not explicitly defined; Capability inventory: File system access and JavaScript execution within the headless browser; Sanitization: The skill does not perform explicit sanitization of user strings before embedding them into HTML.
Audit Metadata