blip-2-vision-language
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and downloads pre-trained model weights, configuration files, and source code from Salesforce's official GitHub repository and the HuggingFace Hub. These are well-known, trusted services for machine learning model distribution.
- [COMMAND_EXECUTION]: Provides standard package installation instructions using
pipfor common dependencies includingtransformers,torch,accelerate, andsalesforce-lavis. - [INDIRECT_PROMPT_INJECTION]: The skill defines workflows for processing external image data and user-provided natural language questions. While this creates a surface for indirect prompt injection, it is the primary intended function of the vision-language model, and the skill follows best-practice implementation patterns for model inference.
- [DYNAMIC_EXECUTION]: Documentation includes the use of
torch.compilefor performance optimization, which is a standard feature of modern PyTorch and does not pose a security risk in this implementation.
Audit Metadata