alibaba-image-models
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides robust guidance on secret management, instructing users to use environment variables for
DASHSCOPE_API_KEYand explicitly warning against hardcoding credentials in source code or logs. - [SAFE]: The included Python example implements strong defenses against Server-Side Request Forgery (SSRF) by verifying that hostnames resolve only to public, global IP addresses before making network requests.
- [SAFE]: The script includes multiple layers of image validation, including pixel-count limits to prevent decompression bomb attacks, strict byte-count caps for streaming downloads, and magic-byte verification for the PNG format.
- [SAFE]: The network implementation is designed to prevent credential leakage by ensuring that authorization headers are not accidentally forwarded when the script follows HTTP redirects to third-party asset hosts.
Audit Metadata