qwen-wanx-comic-gen
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text to generate image prompts, which are then passed to an external API. \n
- Ingestion points: The
--promptcommand-line argument inscripts/gen.pyreceives untrusted user input from the agent. \n - Boundary markers: The script does not employ delimiters or specific instructions to isolate user input from the intended prompt structure. \n
- Capability inventory: The skill possesses network access to Alibaba DashScope for task creation and result polling, and it has filesystem write permissions to store downloaded images. \n
- Sanitization: No input validation or escaping is performed on the prompt before it is sent to the remote service. \n- [EXTERNAL_DOWNLOADS]: The script downloads image assets from Alibaba DashScope's official API domains. \n- [COMMAND_EXECUTION]: The skill operates by executing a local Python script with arguments derived from user requests.
Audit Metadata