image-gen
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied keywords and external API responses from ModelScope. Ingestion points include user input keywords in SKILL.md and API response data in generate.mjs. While boundary markers are absent, the capabilities are limited to executing the local generation script and using curl for image retrieval. Sanitization is limited to logging truncation, but the prompt is handled as a data string in the API request.
- [COMMAND_EXECUTION]: The skill executes a local script named generate.mjs and utilizes the curl utility. These commands are necessary for the skill's primary function of image generation and are not used for unauthorized system access.
- [EXTERNAL_DOWNLOADS]: The skill communicates with api-inference.modelscope.cn, a well-known AI service, and downloads resulting image files. These external interactions are expected for an image generation tool.
Audit Metadata