upscale-image
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill specifies a procedure to locate and execute several local command-line binaries including upscayl-bin, realesrgan-ncnn-vulkan, vipsthumbnail, and cjpeg-mozjpeg.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a vulnerability surface where untrusted user input for file paths or model names is interpolated into shell commands.
- Ingestion points: Input, Scale, Model, Output dir, and Output format fields defined in SKILL.md.
- Boundary markers: Absent. The skill provides no delimiters to isolate user-provided strings within command templates.
- Capability inventory: Execution of subprocesses and file system write operations described in SKILL.md.
- Sanitization: Absent. The skill provides no instructions for sanitizing or escaping user-provided arguments before they are passed to the shell.
Audit Metadata