packaging-design
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Initiates network requests to the Each Labs API endpoint at
eachlabs.runto process image generation and design tasks. - [COMMAND_EXECUTION]: Provides Bash examples using
curlto interact with remote API services. - [PROMPT_INJECTION]: The skill ingests user-provided text and image URLs to generate design assets, which presents an indirect prompt injection surface when handling untrusted input.
- Ingestion points: User-defined message content and
image_urlfields within API request examples inSKILL.md. - Boundary markers: Content is encapsulated within structured JSON objects (e.g.,
"content": "..."). - Capability inventory: Execution of
curlcommands to transmit data to external endpoints. - Sanitization: No explicit sanitization or filtering of user input is demonstrated in the provided examples.
Audit Metadata