image-generation-via-a2a
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill references the use of environment variables (
IMAGES_A2A_KEY,A2A_SECRET) for managing authentication between agents. This aligns with standard security practices for secret management and avoids hardcoding sensitive credentials. - [COMMAND_EXECUTION]: The skill instructs the agent to execute a local command (
pnpm action generate-image). This execution is restricted to the local environment and is necessary for the skill's primary function of generating images via internal scripts. - [SAFE]: The skill manages a potential indirect injection surface by processing data from an external agent. It explicitly instructs the agent to surface an error to the user if the external response cannot be parsed, which prevents the agent from making unsafe assumptions about malformed or malicious data.
- Ingestion points: Data is received via the
callAgentreturn value from the Images agent (SKILL.md). - Boundary markers: The skill does not define explicit delimiters for the text but requires the presence of specific keys (
previewUrl,assetId, etc.) for successful processing. - Capability inventory: The agent parses URLs from the external response and injects them into slide HTML via
<img>tags. - Sanitization: Instructions mandate that the agent must not guess URLs and should instead notify the user if the response is unparseable.
Audit Metadata