CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

26.3 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 75 · 1 finding

HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · plugins/design-assets/skills/favicon-gen/references/format-guide.md

HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.

Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted

excerptplugins/design-assets/skills/favicon-gen/references/format-guide.md· markdown

450

451- **MDN Favicon**: https://developer.mozilla.org/en-US/docs/Glossary/Favicon

452- **Apple Touch Icon**: https://developer.apple.com/library/archive/documentation/AppleAppli

… (93 chars elided on L452)

453- **Web App Manifest**: https://w3c.github.io/manifest/

454- **ICO Format**: https://en.wikipedia.org/wiki/ICO_(file_format)

Occurrences

1 occurrence · at L452

How to fix

Remove the encoded blob, or decode it and review what it actually contains.

Decode the base64 string and confirm it is not an instruction directed at the agent.
Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256e0384f48a55574b7…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

plugins/design-assets/skills/favicon-gen/SKILL.md · 1 file

plugins/design-assets/skills/favicon-gen/SKILL.md4.1 KB · Markdown

name: favicon-gen

description: "Generate custom favicons from logos, text, or brand colours. Produces favicon.svg, favicon.ico, apple-touch-icon.png, icon-192/512.png, and web manifest. Use whenever the user wants a favicon, mentions replacing a CMS default favicon, converting a logo into a favicon, creating branded initials icons, or troubleshooting favicon not displaying / iOS black square / missing manifest."

compatibility: claude-code-only

Favicon Generator

Generate a complete favicon package from a logo, initials, or brand colours. Produces all required formats and HTML integration code.

Workflow

Step 1: Choose Your Approach

Have a logo with an icon element?
 YES -> Extract icon from logo
 NO  -> Have text/initials?
         YES -> Create monogram favicon
         NO  -> Use branded shape

Step 2: Create Source SVG

Extracted icon — copy icon paths from logo, centre in 32x32 viewBox, simplify for small sizes.

Monogram — use a template from assets/:

<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
  <circle cx="16" cy="16" r="16" fill="#0066cc"/>
  <text x="16" y="21" font-size="16" font-weight="bold"
        text-anchor="middle" fill="#ffffff" font-family="sans-serif">AC</text>
</svg>

Branded shape — circle (universal), rounded square (modern), shield (security), hexagon (tech).

SVG templates available in assets/ directory.

Step 3: Generate All Formats

Requires ImageMagick (convert command). Install if needed: brew install imagemagick (macOS) or apt install imagemagick (Linux).

# ICO (16x16 + 32x32)
convert favicon.svg -define icon:auto-resize=16,32 favicon.ico

# Apple Touch Icon (180x180, SOLID background — transparent = black on iOS)
convert favicon.svg -resize 180x180 -background "#0066cc" -alpha remove apple-touch-icon.png

# Android/PWA icons
convert favicon.svg -resize 192x192 icon-192.png
convert favicon.svg -resize 512x512 icon-512.png

No ImageMagick? Use https://favicon.io to convert from the SVG instead.

Step 4: Create Web Manifest

Copy and customise assets/manifest.webmanifest:

{
  "name": "Your Business Name",
  "short_name": "Business",
  "icons": [
    { "src": "/icon-192.png", "sizes": "192x192", "type": "image/png" },
    { "src": "/icon-512.png", "sizes": "512x512", "type": "image/png" }
  ],
  "theme_color": "#0066cc",
  "background_color": "#ffffff",
  "display": "standalone"
}

Step 5: Add HTML Tags

<link rel="icon" type="image/svg+xml" href="/favicon.svg">
<link rel="icon" type="image/x-icon" href="/favicon.ico">
<link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
<link rel="manifest" href="/site.webmanifest">
<meta name="theme-color" content="#0066cc">

Place all files in site root (/public/ in Vite/React).

Critical Rules

Always generate ALL formats — SVG, ICO, apple-touch-icon, 192, 512, manifest
iOS icons MUST have solid backgrounds — transparent = black square
Always use bold font weight for monogram text (regular disappears at 16x16)
Test at 16x16 — if it's not legible, simplify
Never launch with CMS defaults (WordPress "W", etc.)

Format Quick Reference

Format	Size	Transparency	Purpose
`favicon.svg`	Vector	Yes	Modern browsers
`favicon.ico`	16+32	Yes	Legacy browsers
`apple-touch-icon.png`	180x180	No	iOS home screen
`icon-192.png`	192x192	Yes	Android
`icon-512.png`	512x512	Yes	PWA

Asset Files

assets/favicon-svg-circle.svg — Circle monogram template
assets/favicon-svg-square.svg — Rounded square template
assets/favicon-svg-shield.svg — Shield template
assets/manifest.webmanifest — Web manifest template

Reference Files

references/format-guide.md — Complete format specifications
references/extraction-methods.md — Logo icon extraction steps
references/monogram-patterns.md — Advanced monogram design
references/shape-templates.md — Industry-specific shapes with SVG code

favicon-gen— agent skill

Is favicon-gen safe to install?

Favicon Generator

Workflow

Step 1: Choose Your Approach

Step 2: Create Source SVG

Step 3: Generate All Formats

Step 4: Create Web Manifest

Step 5: Add HTML Tags

Critical Rules

Format Quick Reference

Asset Files

Reference Files

Audit the pieces. Scan the whole. Decide.