product-image-processor

Pass

Audited by Gen Agent Trust Hub on May 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Installs the well-known Python packages 'rembg' and 'onnxruntime' via pip to provide AI-based background removal capabilities.
  • [EXTERNAL_DOWNLOADS]: Downloads a pre-trained AI model (u2net, approx 170MB) from the official rembg repository or cache on the first execution.
  • [COMMAND_EXECUTION]: Uses the 'curl' utility to download product images from URLs provided in the user-specified Google Sheet.
  • [COMMAND_EXECUTION]: Generates and runs Python scripts to perform batch image resizing and background removal operations on the local file system.
  • [INDIRECT_PROMPT_INJECTION]: Processes untrusted data from Google Sheets (product names and image URLs).
  • Ingestion points: SKILL.md Step 2 uses 'mcp__google__sheets_values_get' to ingest data.
  • Boundary markers: Absent.
  • Capability inventory: Bash (curl), File-write, and Python script execution.
  • Sanitization: Implements filename 'slugification' (lowercase, hyphenation of special characters) in SKILL.md Step 4 to prevent filesystem command injection via malicious filenames.
Audit Metadata
Risk Level
SAFE
Analyzed
May 11, 2026, 11:58 AM
Security Audit — agent-trust-hub — product-image-processor