Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed local Steam icon repair helper that makes expected changes to the user's Linux icon theme.
Install only if you want a local tool that reads your Steam launchers and writes replacement PNG icons under your user icon theme. Check the app ID and image path first, and be aware that existing steam_icon_<appid>.png files may be overwritten and the icon cache may be refreshed.
The skill instructs the agent to run a local Python script and infer filesystem locations, but it does not declare any tool restrictions or permission scope. In practice this means an agent may use shell, environment access, and file reads/writes more broadly than the user expects, increasing the chance of unintended local file modification or overbroad access during execution.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if not tool:
print("warning: icon cache tool not found; refresh manually if needed", file=sys.stderr)
return
subprocess.run([tool, "-f", "-t", str(icons_dir)], check=True)
def shutil_which(name: str) -> str | None:
The helper uses sh -lc with string interpolation to resolve a command name, which creates an unnecessary shell execution surface. Although current callers use constant candidate names, the function itself is unsafe-by-design and would become command-injection-prone if reused with attacker-controlled input; it also allows PATH-based execution ambiguity because it trusts whatever sh resolves in the environment.
def shutil_which(name: str) -> str | None:
return subprocess.run(
["sh", "-lc", f"command -v {name}"],
capture_output=True,
text=True,
The skill's install workflow writes replacement icon assets into the user's local icon theme and may alter desktop integration behavior, but the description does not clearly warn that local files will be modified. This is dangerous mainly from a safety and consent standpoint: users may not realize the action is persistent, affects desktop launchers, or could overwrite existing icon files.