{"data":{"skill":{"slug":"7and1-create-favicon","name":"create-favicon","icon":"📦","repo":"https://github.com/7and1/favicongenerator-skills/tree/748db3b2fc3b7682a29ddcf4a027e53445b43110/create-favicon","status":"approved","author":"7and1","authorVersion":null,"skillstoreRevision":1,"license":null},"licenseCorrection":null,"audit":{"id":"eac10e9b-242f-4546-84ae-fa303a959a09","skill_id":"f2c12ad8-5011-4de2-ae2b-11992a058948","version":1,"content_hash":"v3:9ec1d999e2cf21ffd82533690aca1918bfc87206:1554c89ddbec03cb43cd9fd0025964d50545b0ce65d984c7cf460fc59f7424ad:1acc274ce63413814395f8e669bb2df49fbf83d0d9a2029930a38b28d24b83a0:736b696c6c732f37616e64312f6372656174652d66617669636f6e:bea2b86a0ba07e969f903999177d4590","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Of 35 static findings, 34 concern Markdown formatting, ordinary favicon API access, or fixed examples rather than dangerous behavior. One finding is confirmed because the instructions direct agents to execute service-returned conversion commands without validation. No evidence found of credential theft, system reconnaissance, or prompt injection in SKILL.md.","remediation":[{"issue":"SKILL.md:42-43 directs execution of convert_commands returned by an external service without validation.","severity":"medium","suggestion":"Use the fixed local conversion commands instead. Invoke allowlisted binaries with argument arrays, validate local paths, and never execute service-returned shell text."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":52,"line_start":45},{"file":"SKILL.md","line_end":55,"line_start":52},{"file":"SKILL.md","line_end":56,"line_start":55},{"file":"SKILL.md","line_end":56,"line_start":56},{"file":"SKILL.md","line_end":66,"line_start":58},{"file":"SKILL.md","line_end":73,"line_start":66},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":78,"line_start":78}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":9,"line_start":9},{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":85,"line_start":85}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":43,"line_start":43}],"confidence":0.94,"description":"installed, run the commands in `convert_commands`:","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The instruction explicitly says to run convert_commands from the external tool response without validation. A compromised service could supply arbitrary commands for local execution."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":86,"audit_model":"codex","audited_at":"2026-11-06T01:26:54.756+00:00","created_at":"2026-11-06T05:42:35.468666+00:00","static_findings":[{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"the HTML `<head>` snippet and site.webmanifest. They do not render PNG or ICO files, so","category":"external_commands","line_end":10,"severity":"medium","line_start":10},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- MCP: `https://favicongenerator.io/mcp` (Streamable HTTP, POST, no auth)","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- REST: `https://favicongenerator.io/api` (GET, JSON or SVG)","category":"external_commands","line_end":14,"severity":"medium","line_start":14},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Brand initial or short text** (1–2 characters): `generate_text_favicon`,","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"or `GET https://favicongenerator.io/api/text-favicon?text=A&background_start=%230f172a&text_color=%2","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Emoji**: the same tool with `text` set to the emoji. Use `background_start=transparent`","category":"external_commands","line_end":21,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Generic symbol** (rocket, cart, heart, ...): `search_icons` with a keyword","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"(`GET /api/icons?query=rocket`), then `get_icon_svg` with the id","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"(`GET /api/icons/rocket?color=%232563eb&dark_color=%2393c5fd`). Favicons cannot inherit","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`currentColor`, so always pass a color.","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Colors are hex (`#rrggbb` or `#rgb`); URL-encode `#` as `%23` in REST queries. Unknown","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The tool result has `svg`, `html`, `manifest` and `convert_commands`.","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Save `svg` as `favicon.svg` in the site's static root (`public/` in Next.js, Vite and","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"most frameworks; `static/` in SvelteKit and Hugo; the web root for plain HTML).","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Save `manifest` as `site.webmanifest` and set `name` and `short_name` to the site's","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"name (or pass `name` / `short_name` to the tool).","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. Create the bitmap files from favicon.svg. If `rsvg-convert` and ImageMagick are","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"installed, run the commands in `convert_commands`:","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```sh","category":"external_commands","line_end":52,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":55,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"renders blank or monochrome, give the user `generator_url` from the result instead.","category":"external_commands","line_end":56,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. Paste `html` into the `<head>` of every page, or the shared layout:","category":"external_commands","line_end":56,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```html","category":"external_commands","line_end":66,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":73,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`get_platform_guide` (`GET /api/platforms/wordpress`) returns the file and the menu path.","category":"external_commands","line_end":73,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/favicon.ico`, `/favicon.svg` and `/site.webmanifest` return 200 from the deployed site.","category":"external_commands","line_end":78,"severity":"medium","line_start":78},{"id":"network:SKILL.md:9:python-http-libraries","file":"SKILL.md","pattern":"Python HTTP libraries","snippet":"read-only, need no key and allow cross-origin requests. They return favicon.svg as text,","category":"network","line_end":9,"severity":"low","line_start":9},{"id":"network:SKILL.md:8:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://favicongenerator.io/ generates favicons. Its MCP server and REST API are free,","category":"network","line_end":8,"severity":"low","line_start":8},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- MCP: `https://favicongenerator.io/mcp` (Streamable HTTP, POST, no auth)","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:SKILL.md:14:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- REST: `https://favicongenerator.io/api` (GET, JSON or SVG)","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:SKILL.md:15:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Argument reference: https://favicongenerator.io/llms-full.txt","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:SKILL.md:20:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"or `GET https://favicongenerator.io/api/text-favicon?text=A&background_start=%230f172a&text_color=%2","category":"network","line_end":20,"severity":"low","line_start":20},{"id":"network:SKILL.md:28:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://favicongenerator.io/image (PNG/JPG) or https://favicongenerator.io/svg (SVG);","category":"network","line_end":28,"severity":"low","line_start":28},{"id":"network:SKILL.md:85:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Credit https://favicongenerator.io/ where you show the result.","category":"network","line_end":85,"severity":"low","line_start":85},{"id":"blocker:SKILL.md:24:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"(`GET /api/icons?query=rocket`), then `get_icon_svg` with the id","category":"blocker","line_end":25,"severity":"low","line_start":24}],"finding_verdicts":[{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","reason":"The backticks format an HTML head element in Markdown. No Ruby or shell execution appears here.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"The backticks delimit the documented MCP endpoint, not an executable expression. The line contains no shell invocation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","reason":"This is a Markdown-formatted REST endpoint with its response formats. Backticks do not execute commands in this document.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"generate_text_favicon is a documented tool name in inline code. No Ruby or shell evaluation is requested.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The inline example describes an HTTP GET for a public favicon with fixed text and colors. It is not shell backtick execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"The inline code names text and background parameters for emoji generation. These are Markdown literals, not executable expressions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"search_icons names the favicon service's icon search tool. Its inline formatting does not invoke a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The line documents an icon search request and get_icon_svg tool call. Neither inline code span is Ruby or shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"This is an icon API path with explicit color parameters. Markdown backticks enclose a request example, not a command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"currentColor is an SVG color keyword shown as inline code. No external command is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The backticks format hexadecimal color syntax and URL encoding examples. There is no executable command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The line lists response field names, including convert_commands, without executing them. The later instruction to execute that field is adjudicated separately.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"Inline code identifies the SVG response field, output filename, and framework directory. These are expected favicon integration instructions, not shell backticks.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"static/ is a documented framework asset directory. Its Markdown formatting is not code execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"This line describes saving a manifest and setting its name fields. The inline literals do not invoke external commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"name and short_name are documented API parameters for the site manifest. No shell execution appears here.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"rsvg-convert is named as a prerequisite for legitimate local image conversion. The unsafe execution of returned commands is addressed on line 43.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The instruction explicitly says to run convert_commands from the external tool response without validation. A compromised service could supply arbitrary commands for local execution.","verdict":"confirmed","severity":"medium","confidence":0.94},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The fenced block contains fixed rsvg-convert and ImageMagick commands using local favicon files. No user-controlled shell interpolation or Ruby backtick execution appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"This closes a Markdown fence and describes deleting two named temporary PNGs or offering a browser fallback. It contains no shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"generator_url is a response field offered as a browser fallback. The following HTML integration instruction also uses Markdown literals, not shell backticks.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The line describes inserting favicon HTML into the page head. No Ruby or shell command substitution appears.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The HTML fence contains local icon links, a manifest link, and theme-color metadata. These tags do not execute shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"This closes an HTML fence and continues with stale-tag cleanup and platform guidance. The backticks are Markdown syntax, not executable shell syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"get_platform_guide and the platform API path are documented inline. They request installation guidance rather than shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"The inline paths identify deployed favicon assets whose HTTP status should be checked. They are not shell commands.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:9:python-http-libraries","reason":"The word requests appears in prose about cross-origin requests. No Python HTTP library import or invocation exists in the file.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:8:hardcoded-url","reason":"The URL identifies the favicon service central to the declared workflow. No secret transmission or unrelated destination is specified.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The HTTPS MCP endpoint supports the skill's stated favicon generation purpose without authentication. No credential collection or unrelated data transfer is instructed.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:14:hardcoded-url","reason":"The HTTPS REST endpoint is the documented alternative for favicon generation. Its presence alone does not establish a dangerous network operation.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:15:hardcoded-url","reason":"The URL points to the same service's argument reference. No instructions to transmit local files or secrets accompany this documentation link.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:20:hardcoded-url","reason":"The sample request sends only a brand initial and color values for the requested favicon. No sensitive payload or covert destination is shown.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:28:hardcoded-url","reason":"These links direct users to browser-based logo conversion because the API does not accept uploads. The skill does not instruct automatic local-file transmission.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:85:hardcoded-url","reason":"This is an explicit attribution request for the declared favicon service. It does not instruct secret transmission, tracking code insertion, or hidden network access.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:24:system-reconnaissance","reason":"The id belongs to an icon search result used to retrieve SVG artwork. No operating-system identity query or system reconnaissance is requested.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"9ec1d999e2cf21ffd82533690aca1918bfc87206","subject_content_hash":"1554c89ddbec03cb43cd9fd0025964d50545b0ce65d984c7cf460fc59f7424ad","subject_tree_hash":"1acc274ce63413814395f8e669bb2df49fbf83d0d9a2029930a38b28d24b83a0","subject_plugin_path":"skills/7and1/create-favicon","audit_payload_hash":"bea2b86a0ba07e969f903999177d4590","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"9ec1d999e2cf21ffd82533690aca1918bfc87206","contentHash":"1554c89ddbec03cb43cd9fd0025964d50545b0ce65d984c7cf460fc59f7424ad","treeHash":"1acc274ce63413814395f8e669bb2df49fbf83d0d9a2029930a38b28d24b83a0","pluginPath":"skills/7and1/create-favicon","auditPayloadHash":"bea2b86a0ba07e969f903999177d4590"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/7and1-create-favicon/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}