product-image-processor
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Installs the well-known Python packages 'rembg' and 'onnxruntime' via pip to provide AI-based background removal capabilities.
- [EXTERNAL_DOWNLOADS]: Downloads a pre-trained AI model (u2net, approx 170MB) from the official rembg repository or cache on the first execution.
- [COMMAND_EXECUTION]: Uses the 'curl' utility to download product images from URLs provided in the user-specified Google Sheet.
- [COMMAND_EXECUTION]: Generates and runs Python scripts to perform batch image resizing and background removal operations on the local file system.
- [INDIRECT_PROMPT_INJECTION]: Processes untrusted data from Google Sheets (product names and image URLs).
- Ingestion points: SKILL.md Step 2 uses 'mcp__google__sheets_values_get' to ingest data.
- Boundary markers: Absent.
- Capability inventory: Bash (curl), File-write, and Python script execution.
- Sanitization: Implements filename 'slugification' (lowercase, hyphenation of special characters) in SKILL.md Step 4 to prevent filesystem command injection via malicious filenames.
Audit Metadata