image-generation-via-a2a

Pass

Audited by Gen Agent Trust Hub on Jul 13, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill references the use of environment variables (IMAGES_A2A_KEY, A2A_SECRET) for managing authentication between agents. This aligns with standard security practices for secret management and avoids hardcoding sensitive credentials.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute a local command (pnpm action generate-image). This execution is restricted to the local environment and is necessary for the skill's primary function of generating images via internal scripts.
  • [SAFE]: The skill manages a potential indirect injection surface by processing data from an external agent. It explicitly instructs the agent to surface an error to the user if the external response cannot be parsed, which prevents the agent from making unsafe assumptions about malformed or malicious data.
  • Ingestion points: Data is received via the callAgent return value from the Images agent (SKILL.md).
  • Boundary markers: The skill does not define explicit delimiters for the text but requires the presence of specific keys (previewUrl, assetId, etc.) for successful processing.
  • Capability inventory: The agent parses URLs from the external response and injects them into slide HTML via <img> tags.
  • Sanitization: Instructions mandate that the agent must not guess URLs and should instead notify the user if the response is unparseable.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 13, 2026, 04:51 AM
Security Audit — agent-trust-hub — image-generation-via-a2a