frontend-color-system
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION] (SAFE): The skill contains several bash snippets utilizing
curl,jq, andgrep. These are used appropriately for fetching and parsing structured data from color-related APIs (TheColorAPI and WebAIM). - [EXTERNAL_DOWNLOADS] (LOW): The skill communicates with non-whitelisted domains
www.thecolorapi.comandwebaim.org. These requests are functionally necessary for the skill's purpose of color identification and accessibility validation. - [INDIRECT_PROMPT_INJECTION] (LOW): The skill processes data from external APIs.
- Ingestion points: Data returned from
thecolorapi.comandwebaim.orgis processed by scripts. - Boundary markers: Absent in the bash examples.
- Capability inventory: The skill has access to
WriteandBash (*)permissions, which could be misused if an API response contained malicious instructions. - Sanitization: The use of
jqandgrep -oeffectively filters the external data to only the required numeric or hex values, significantly reducing the attack surface.
Audit Metadata