creative-production-offer-explorer
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/build_offer_explorer.pyscript usessubprocess.runto call a local runtime script (codex_exec_image_batch.py). This is a standard architectural pattern for this skill to handle batch image generation. The command is constructed safely as a list of arguments without invoking a shell. - [SAFE]: The skill follows security recommendations outlined in
references/codex-exec-image-generation.md, specifically closingstdin(redirecting to/dev/null) when launching child processes to prevent potential interactive hangs or unauthorized input consumption. - [SAFE]: The skill processes untrusted user data (campaign/product briefs) which are interpolated into image generation prompts. While this represents an indirect prompt injection surface, the impact is confined to the image generation output and does not grant access to sensitive system operations.
- Ingestion points: User briefs ingested from CLI arguments or local files in
scripts/build_offer_explorer.py. - Boundary markers: Not present; briefs are directly included in the prompt templates.
- Capability inventory: Subprocess execution (
subprocess.run) and image generation via Codex. - Sanitization: None; input is used as provided for creative prompting.
Audit Metadata