visual-assets-generator
Pass
Audited by Gen Agent Trust Hub on Mar 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a local script,
generate-svg.ts, executed vianpx tsxto handle the generation and validation of animated SVGs. This script performs file system operations, specifically writing generated SVG content to user-specified output paths. - [EXTERNAL_DOWNLOADS]: The skill interacts with external APIs, including Google's Gemini API for SVG generation and OpenRouter for image generation. These are well-known services used for their intended creative purposes.
- [DATA_EXFILTRATION]: The SVG generation script accesses environment variables (
GEMINI_API_KEYorVITE_GEMINI_API_KEY) to authenticate requests to the Gemini API. This is a standard practice for API-integrated tools. - [SAFE]: The
generate-svg.tsscript incorporates a security validation layer (validateSvg) that checks for and rejects generated content containing<script>tags,javascript:URIs, or excessive file sizes, mitigating risks associated with untrusted LLM output.
Audit Metadata