gpt-image-by-acedatacloud
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill connects to the vendor-owned MCP endpoint at
openai.mcp.acedata.cloud. This is expected behavior for the stated purpose of the skill and represents normal integration with the author's services. - [CREDENTIALS_UNSAFE]: The skill correctly uses environment variables (
ACEDATACLOUD_API_TOKEN) for authentication, avoiding the risk of hardcoded credentials in the source code. - [INDIRECT_PROMPT_INJECTION]: The skill manages an attack surface for indirect injection by ingesting image task data from external APIs. 1. Ingestion points: The
openai_get_tasktool returns data from the external Ace Data Cloud API into the agent context. 2. Boundary markers: The instructions inSKILL.mdact as markers by requiring the agent to confirm pricing and parameters with the user and report only original results. 3. Capability inventory: The skill uses MCP tools for image generation and task polling; it does not have file system or shell execution capabilities. 4. Sanitization: No explicit code-level sanitization is performed by the skill, but tool access is restricted via themcp.jsonconfiguration.
Audit Metadata