extension-assets
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands for project setup and asset management. These include 'npm install' for dependencies, 'node' for running a conversion script, and 'convert'/'identify' (ImageMagick) for image manipulation.
- [EXTERNAL_DOWNLOADS]: The skill installs the 'sharp' library from the public NPM registry. It also provides a workflow to fetch generated image assets directly from Google's Gemini API (generativelanguage.googleapis.com) using 'curl'.
- [CREDENTIALS_UNSAFE]: The documentation mentions managing a 'GEMINI_API_KEY' via environment variables or shell profiles. These are standard practices for developer tools and no hardcoded secrets or exfiltration patterns were detected.
Audit Metadata