qwen-image-2
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions prompt the user to install the
belt-sh/clipackage and additional skills from theinference-shorganization on GitHub. These tools are required to interact with the underlying Alibaba models and the inference.sh platform. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user that is then passed to a high-capability inference tool, creating a potential vector for indirect prompt injection.
- Ingestion points: Untrusted data enters the agent context through the
promptandreference_images(image URIs) parameters in the skill's example workflows. - Boundary markers: The instructions do not define explicit delimiters or "ignore embedded instructions" warnings for the
promptorreference_imagescontent. - Capability inventory: The skill is granted access to the
Bashtool (specifically thebeltcommand) to execute image generation tasks and perform network operations via the CLI. - Sanitization: There is no evidence of input validation, URL filtering, or escaping for the user-provided prompt strings or reference image URIs before they are processed by the CLI.
Audit Metadata