segment-image

Warn

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/segment.ts employs dynamic path resolution to locate and import its core dependencies such as resolve-root.ts, utils.ts, and shared.ts. It attempts to resolve these by scanning various local directory structures, including environment-defined paths, the Claude plugin installation registry (~/.claude/plugins/installed_plugins.json), and versioned cache directories in the user's home directory.
  • [INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by ingesting external data (images) and user-supplied prompts which are then interpolated into requests sent to the Gemini vision model.
  • Ingestion points: The inputPath parameter (image file) and flags.prompt (text prompt) are the primary entry points for external data in scripts/segment.ts.
  • Boundary markers: The script does not utilize specific delimiters or instruction-isolation markers to prevent the model from following commands potentially embedded in the image content or custom prompt.
  • Capability inventory: The script possesses filesystem read/write capabilities through fs and fs/promises (writeFile, mkdir, readFileSync, readdirSync) and performs network requests to external AI services.
  • Sanitization: The script performs sanitization on output filenames generated from model labels using a regular expression to strip non-alphanumeric characters.
  • [COMMAND_EXECUTION]: The SKILL.md file instructs the agent to execute shell commands using bun run to invoke the segmentation script, providing a path for the agent to perform filesystem operations and network calls.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 5, 2026, 02:50 AM