image-generation-gateways
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a defensive multi-step approval workflow using a specialized validation script to enforce spend ceilings, schema integrity, and cryptographic plan digests before any network operations occur.
- [SAFE]: Secret management follows best practices by utilizing environment variables for API tokens and includes specialized scanning logic to detect and block credentials from being included in plan or ledger files.
- [SAFE]: Network operations are hardened with multiple security layers, including DNS resolution filtering to ensure assets are fetched from public addresses, mandatory HTTPS enforcement, and the explicit rejection of HTTP redirects to prevent SSRF and data exfiltration.
- [SAFE]: Artifact downloads are strictly validated for origin, MIME type, size, and integrity using magic byte checks and full image decoding with Pillow to prevent malicious payload delivery or polyglot file attacks.
- [SAFE]: The requirement for a cryptographic hash over the entire generation plan, including the prompt and output policy, acts as a primary defense against unauthorized or injected commands by ensuring only pre-approved configurations reach the gateway endpoints.
Audit Metadata