retro-diffusion
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill communicates with the official Retro Diffusion API at
api.retrodiffusion.aito perform image generation. This is a legitimate and expected network connection for the skill's functionality. - [CREDENTIALS_UNSAFE]: The skill uses environment variables (
RETRO_DIFFUSION_API_KEYorRD_API_KEY) to handle authentication, which is a recommended security practice for managing API keys. - [DATA_EXFILTRATION]: Local image data and prompts are sent to the Retro Diffusion API as part of the normal workflow. There is no evidence of sensitive system data being collected or transmitted.
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes external files. Ingestion points: The
scripts/retro_inference_run.pyscript accepts text prompts from files and local images. Boundary markers: No explicit delimiters are used in the API payload. Capability inventory: The skill can make network requests and write to the local file system. Sanitization: The input data is not sanitized before being sent to the API.
Audit Metadata