luma-photon
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implementation follows security best practices and contains no malicious patterns. Evidence includes robust error handling and defensive coding in the provided Python integration script.
- [DATA_EXFILTRATION]: Network communication is restricted to the official Luma AI API domain. The script includes explicit checks to ensure the
LUMAAI_API_KEYis only sent to the authenticated API endpoint and never forwarded to source image hosts or CDN redirect targets. - [EXTERNAL_DOWNLOADS]: The skill safely handles external image references and generated assets. It includes a validation suite that checks for HTTPS, exact host matches, and verifies that DNS resolution points exclusively to public (non-local) IP addresses to prevent Server-Side Request Forgery (SSRF).
- [COMMAND_EXECUTION]: All file and network operations are performed using standard Python library functions. There are no shell command executions, subprocess spawns, or instances of arbitrary code evaluation.
Audit Metadata