image-generation
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the google-genai and Pillow libraries. These are well-known and trusted packages for interacting with Google's AI services and performing image manipulation.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text prompts through Python variables and CLI arguments for image generation. While this represents a data ingestion surface, it is consistent with the skill's primary purpose and lacks dangerous patterns. Boundary markers and sanitization are absent, which is typical for this use case.
- [COMMAND_EXECUTION]: The skill documentation includes examples for running a local CLI utility (tools/gemini-generate.py). This is standard functionality for providing a command-line interface to the generation pipeline.
- [CREDENTIALS_UNSAFE]: The skill correctly avoids hardcoding credentials by instructing the user to set the GEMINI_API_KEY environment variable.
Audit Metadata