generate-image
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill processes user-supplied text prompts and image files which are sent to a remote AI model, creating a surface for indirect prompt injection.
- Ingestion points: User-provided
promptCLI argument and local image files (--input) inscripts/generate_image.py. - Boundary markers: Absent. User content is sent to the API without delimiters or warnings.
- Capability inventory: Network operations via
requests.posttoopenrouter.aiand local file writes to save images. - Sanitization: Absent. Prompts and images are sent to the remote model without validation or escaping.
- [DATA_EXFILTRATION]: The script
scripts/generate_image.pyreads the.envfile to retrieve theOPENROUTER_API_KEY. This is a standard method for credential management. The script also reads local image files provided by the user via command-line arguments. Network communication is directed to the well-known serviceopenrouter.ai. - [EXTERNAL_DOWNLOADS]: The skill utilizes the
requestslibrary for communicating with the OpenRouter API. While this is an external dependency, it is a standard library for network operations.
Audit Metadata