CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · CHANGELOG.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptCHANGELOG.md· markdown

133- **Four new skills (→ 12 total).** Long-tail gaps the asset-type skills don't cover. No MCP

… (102 chars elided on L133)

134- `svg-authoring` — engaged whenever `asset_generate_*` returns an `InlineSvgPlan`. Enforces

… (106 chars elided on L134)

135- `t2i-prompt-dialect` — engaged during prompt rewriting. Per-model rules for `gpt-image-1`,

… (106 chars elided on L135)

136- `asset-validation-debug` — engaged when `asset_validate` or a generator returns warnings.

… (106 chars elided on L136)

137- `brand-consistency` — engaged for multi-asset sets. Builds `BrandBundle` (palette, typogra

… (106 chars elided on L137)

Occurrences

1 occurrence · at L135

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha256183eb789192b5159…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

plugins/prompt-to-asset/skills/og-image/SKILL.md · 1 file

plugins/prompt-to-asset/skills/og-image/SKILL.md3.0 KB · Markdown

name: og-image

description: Generate an Open Graph / Twitter Card social unfurler image — 1200×630 JPEG/PNG, <5MB, with deterministic typography. Defaults to Satori + @resvg/resvg-js template rendering (no diffusion). Diffusion is optional and only for the hero art layer composited behind the template.

trigger_phrases: [og image, open graph image, social card, twitter card, link preview]

OG image generation

Spec

Dimensions: 1200×630 (OG 1.91:1) primary. Optional: 1080×1080 square (Instagram), 2:1 Twitter Card summary_large_image.
Format: PNG or JPEG, <5MB, served over absolute HTTPS URL, no auth headers.
Text: Deterministic — use Satori + real fonts. Never sample typography from a diffusion model for OG cards; headlines get garbled (see logo skill § 3-word rule).
Headline: ≤8 words, 64–96pt. Subheadline: ≤15 words, 28–36pt.
Contrast: WCAG AA min 4.5:1 (Slack/Discord render inside their own color backgrounds).

Architecture

Default: template-based, no diffusion. The OG engine is:

Satori — converts JSX or HTML+CSS to SVG with real font shaping.
`@resvg/resvg-js` — rasterizes the SVG to PNG deterministically, no system fonts leaked.
Optional hero layer — if brief says "with illustration," diffusion-generate a 1200×630 background and composite the Satori-rendered text layer on top.
`@vercel/og` — reference Satori wrapper if running inside Next.js/Vercel.

brief + brand bundle
   ↓
pick template (centered hero, left-aligned, minimal)
   ↓
fill template slots:
   - title (required)
   - subtitle (optional)
   - logo.svg (optional, brand bundle)
   - accent color (brand palette)
   - background: solid | gradient | image
   ↓
[optional] generate background image (diffusion, see skills/hero or skills/illustration)
   ↓
satori(jsx) → SVG
   ↓
resvg.render(svg) → 1200×630 PNG
   ↓
validate: dimensions exact, <5MB, contrast, no-text-cropped

Templates (canonical)

Template id	Layout	Use for
`centered_hero`	title + subtitle centered; logo bottom-left	launch posts, generic pages
`left_title`	title left-aligned; hero image right	feature pages, blog posts
`minimal`	title + brand color block	landing pages
`quote`	pull-quote + attribution	blog, documentation
`product_card`	logo + product name + tagline + accent bar	product pages

Templates live as JSX/TSX strings in packages/mcp-server/src/templates/og/*.tsx.

Validation

Width = 1200, height = 630 exactly.
File <5MB.
No text in outer 60px gutter (Slack/Twitter crop aggressively).
WCAG AA contrast between headline and background (measure average luminance in the text-bbox region).
If brand logo included: logo has a minimum size of 60×60px rendered.

Output

og/
├── og.png        # 1200×630 PNG
├── og.jpg        # 1200×630 JPEG (higher compression)
├── og-2x.png     # 2400×1260 retina (optional)
└── meta.json

og-image-d578e7— agent skill

Is og-image-d578e7 safe to install?

OG image generation

Spec

Architecture

Templates (canonical)

Validation

Output

Audit the pieces. Scan the whole. Decide.