product-photography
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses the
allowed-tools: Bash(belt *)configuration to enforce the principle of least privilege, ensuring that the AI agent can only execute the specificbeltcommand and cannot run arbitrary shell commands. - [EXTERNAL_DOWNLOADS]: The skill references documentation and installation scripts from
raw.githubusercontent.com/inference-sh/, which corresponds to the official GitHub organization for the documentedinference.shservice. These references are documented neutrally as they originate from the tool's official source. - [INDIRECT_PROMPT_INJECTION]: The skill provides templates for interpolating user-provided text into command arguments for image generation. This represents an ingestion surface for untrusted data, but the risks are mitigated by the explicit tool-scoping restrictions and the structured JSON format used for inputs.
Audit Metadata