image-remove-background
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx agent-media@latestto download and execute the latest version of a tool from the npm registry. It also fetches pre-trained models from the Hugging Face repository for local processing via Transformers.js. - [REMOTE_CODE_EXECUTION]: The execution of
npx agent-media@latestinvolves fetching code from a remote registry and running it on the host system. - [COMMAND_EXECUTION]: The skill's primary interface is the shell command
agent-media image remove-background, which accepts various user-provided options to control its execution. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The
--inparameter inSKILL.mdaccepts paths to local files or remote URLs, which are then processed by the tool. - Boundary markers: No delimiters or specific instructions are included to prevent the agent from acting on instructions that might be embedded in image metadata or delivered via the remote URL.
- Capability inventory: The skill triggers shell command execution to invoke the
agent-mediautility. - Sanitization: No sanitization or content validation for the input source is mentioned in the provided skill documentation.
Audit Metadata