gi
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a Node.js helper script (generate-image.mjs) to perform API configuration and image generation tasks.\n- [EXTERNAL_DOWNLOADS]: The helper script performs network requests to download generated image assets from URLs provided by the configured API endpoint. Additionally, documentation instructions use npx to install the skill from the vendor's repository.\n- [CREDENTIALS_UNSAFE]: API keys are managed by accepting them as command-line arguments during setup and storing them in a local configuration file (~/.claude/generate-image/config.json). The helper script mitigates risk by explicitly setting restrictive file permissions (0600) on the configuration file.\n- [DATA_EXFILTRATION]: Transmits user prompts and API keys to user-configured endpoints. While a core functional requirement, this behavior relies on the user providing a trustworthy endpoint.\n- [PROMPT_INJECTION]: Processes user-supplied prompts that are forwarded to external image generation models, representing a surface for indirect prompt injection.
Audit Metadata