Baoyu Image Cards
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill reads and writes configuration files in the user's home directory (e.g.,
~/.config/baoyu-skills/baoyu-image-cards/EXTEND.md). This is standard behavior for managing user preferences across different projects and does not target sensitive system credentials. - [PROMPT_INJECTION]: The skill processes user-supplied source content and interpolates it into image generation prompts without explicit sanitization. This presents a potential surface for indirect prompt injection, where malicious instructions within the source text could attempt to influence the image generation process. However, the risk is limited to the visual output and does not grant additional system capabilities.
- [COMMAND_EXECUTION]: The skill is designed to invoke external image generation tools such as
imagegen,image_generate, andbaoyu-imagine. These are legitimate tool invocations required for the skill's primary purpose and rely on tools already available to the agent runtime.
Audit Metadata