openai-image-gen

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a Python script to perform image generation. The command execution patterns in SKILL.md are standard invocations of the provided local script using python3.
  • [DATA_EXPOSURE]: The skill accesses the OPENAI_API_KEY environment variable, which is the standard method for authenticating with the OpenAI API. It also generates an output directory in the user's home folder (~/Projects/tmp) or current working directory, which is typical for this type of utility.
  • [REMOTE_CODE_EXECUTION]: All network operations are performed using standard Python libraries (urllib) to communicate with the OpenAI API. There are no patterns of downloading and executing remote scripts or code.
  • [EXTERNAL_DOWNLOADS]: The script connects to api.openai.com (or a user-configured base URL) to send image generation requests and receive image data in Base64 format. These are expected operations for an image generation tool.
  • [COMMAND_INJECTION]: The script uses the argparse module to handle user input safely as command-line arguments. User-provided prompts are processed and slugified before being used in filenames, mitigating risks associated with shell injection via filenames.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 07:45 PM
Security Audit — agent-trust-hub — openai-image-gen