xai-grok-imagine-image
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes functionality to download generated images and artifacts from xAI's official domains (imgen.x.ai, files-cdn.x.ai). These operations are documented with appropriate safety controls, including host allowlisting and protocol verification.
- [COMMAND_EXECUTION]: The documentation provides curl command snippets intended for model discovery and environment verification against official xAI API endpoints.
- [REMOTE_CODE_EXECUTION]: The provided Python examples demonstrate secure handling of external data, implementing defensive measures such as strict MIME type validation, magic byte checks, and pixel-count caps to protect against decompression bomb attacks.
- [DATA_EXFILTRATION]: All network traffic is directed to the official xAI API infrastructure. The skill follows best practices by retrieving credentials from environment variables rather than hardcoding secrets, and it explicitly warns against forwarding authorization tokens to artifact download URLs.
Audit Metadata