qwen-image
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install the
mcp-qwen-imagepackage using pip. This is a vendor-specific tool provided by the author, acedatacloud, to facilitate integration with their services. - [COMMAND_EXECUTION]: The documentation includes
curlcommand examples to interact with the API atapi.acedata.cloudfor generating and retrieving image tasks. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: User-supplied prompts and image URLs are used as input for API requests defined in
SKILL.md. - Boundary markers: None specified; the skill uses standard interpolation of user inputs into JSON payloads.
- Capability inventory: The skill performs network operations by sending data to the vendor's API endpoint.
- Sanitization: No explicit sanitization or validation logic is provided within the skill's instructions for the external content.
Audit Metadata