modelscope-api
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill communicates with the ModelScope API (api-inference.modelscope.cn) for image generation and editing. ModelScope is a well-known AI platform, and the network operations are consistent with the skill's stated purpose.
- [SAFE]: API credentials are not hardcoded; the skill correctly instructs the user to provide the MODELSCOPE_API_KEY through environment variables.
- [INDIRECT_PROMPT_INJECTION]: The skill provides an interface for sending user-controlled text and image data to an external AI model, creating a potential surface for indirect prompt injection.
- Ingestion points: Command-line arguments for prompts (-p) and local image files (-i) processed by image-editor.js and image-generator.js.
- Boundary markers: None identified in the JSON request body construction in either script.
- Capability inventory: Performs network requests via fetch and writes generated files to the local disk using fs.writeFileSync in both image-generator.js and image-editor.js.
- Sanitization: Inputs are passed directly to the API without filtering or escaping.
Audit Metadata