generate-image
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: Credentials management. The skill securely stores API keys in a configuration file within the user's home directory (~/.claude/generate-image/config.json). It applies restricted file permissions (0o600) to ensure the key is only accessible by the owner. It also provides a clear setup flow (/gi-setup) to guide users on how to provide credentials safely.
- [SAFE]: Network activity. The helper script uses the fetch API to communicate with a user-configured endpoint for image generation and to download the resulting image assets. This behavior is consistent with the skill's stated purpose and user-controlled through configuration.
- [SAFE]: Command execution. The skill uses a provided Node.js script to handle generation logic. The script uses only standard built-in modules and does not perform any dangerous dynamic code execution or unauthorized system commands.
- [SAFE]: Local data management. The skill creates placeholders and manages a JSON-based image index in a local project directory (.claybe/.generate-image). This provides traceability and structured access to generated assets without compromising system security.
Audit Metadata