segment-image
Warn
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/segment.tsemploys dynamic path resolution to locate and import its core dependencies such asresolve-root.ts,utils.ts, andshared.ts. It attempts to resolve these by scanning various local directory structures, including environment-defined paths, the Claude plugin installation registry (~/.claude/plugins/installed_plugins.json), and versioned cache directories in the user's home directory. - [INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by ingesting external data (images) and user-supplied prompts which are then interpolated into requests sent to the Gemini vision model.
- Ingestion points: The
inputPathparameter (image file) andflags.prompt(text prompt) are the primary entry points for external data inscripts/segment.ts. - Boundary markers: The script does not utilize specific delimiters or instruction-isolation markers to prevent the model from following commands potentially embedded in the image content or custom prompt.
- Capability inventory: The script possesses filesystem read/write capabilities through
fsandfs/promises(writeFile,mkdir,readFileSync,readdirSync) and performs network requests to external AI services. - Sanitization: The script performs sanitization on output filenames generated from model labels using a regular expression to strip non-alphanumeric characters.
- [COMMAND_EXECUTION]: The
SKILL.mdfile instructs the agent to execute shell commands usingbun runto invoke the segmentation script, providing a path for the agent to perform filesystem operations and network calls.
Audit Metadata