Skills
skills/andrewii23/ii23-skills/image-gen-router/Gen Agent Trust Hub

image-gen-router

Warn

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts scripts/gen_gemini.py and scripts/gen_gpt.py use subprocess.run to call local CLI tools (agy and codex). This execution path allows the AI agent to interact with the host system's shell environment through these utilities.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the user-provided prompt. The scripts interpolate this untrusted input into a larger 'instruction' string sent to the backend CLI agents.\n
  • Ingestion points: The image prompt provided by the user, accessed via the prompt argument or --prompt-file in both backend scripts.\n
  • Boundary markers: The scripts use only a simple PROMPT:\n label to separate instructions from user input. This is insufficient to prevent an attacker from 'escaping' the prompt context to issue direct instructions to the underlying CLI agent.\n
  • Capability inventory: The instruction strings explicitly use administrative and file system capabilities (e.g., ls -la, shutil.copyfile). In scripts/gen_gemini.py, the agy tool is invoked with --dangerously-skip-permissions, which removes a layer of user oversight for actions performed by the backend agent.\n
  • Sanitization: No sanitization, escaping, or validation is performed on the user prompt before it is passed to the backend tools, making it possible for a malicious prompt to hijack the CLI agent's execution logic.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 13, 2026, 02:42 PM
Security Audit — agent-trust-hub — image-gen-router