image-edit
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and executes the
luxin-clipackage from NPM usingnpx. This is the primary interface for the service and is maintained by the skill's author. - [EXTERNAL_DOWNLOADS]: The skill uses the
skillsmanager to install additional configurations from the author's GitHub repository (github.com/danielgwilson/luxin). - [COMMAND_EXECUTION]: The skill utilizes shell commands to manage environment variables (
HOME,CODEX_HOME) and create local directories (.agent-home,.codex) for maintaining agent state and skill configuration. - [DATA_EXFILTRATION]: Image data and prompts are sent to the hosted API (
api.luxin.sh) for processing. This network communication is essential for the functionality of the hosted editing service. - [INDIRECT_PROMPT_INJECTION]: As the skill processes user-supplied prompts and external images to perform edits, it possesses an attack surface for indirect prompt injection. However, this behavior is the primary intended function of the image editing tool.
Audit Metadata