token-aware-image
Security checks across malware telemetry and agentic risk
Overview
The skill's files and runtime instructions are coherent with its stated purpose (generate themed React TSX image components and render PNGs); it requires creating a local workspace and installing npm and Playwright artifacts which are expected for this functionality.
This skill appears internally consistent with its goal of generating token-driven React image components, but before running it you should: 1) Review and approve the workspace changes — the script will create a .token-image/ directory and write files into your project. 2) Inspect the generated package.json and the external npm dependency @zane-chen/token-image (and any transitive dependencies) before running npm install; npm installs can run arbitrary install scripts. 3) Be aware SKILL.md asks you to run `npx playwright install chromium`, which downloads browser binaries. If you prefer, run init.sh and installs in an isolated/sandboxed environment (container, VM) or a throwaway branch. 4) If you provide a custom tokens.json path, the skill will read that file — only provide files you trust. 5) If you need a stricter review, check the contents of .token-image/src and node_modules after installation and consider pinning versions or using an audit tool (npm audit, vendor lockfile) before rendering.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
67/67 vendors flagged this skill as clean.