9router-image
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill points users to setup instructions located in the vendor's official GitHub repository at
github.com/decolua/9router.- [INDIRECT_PROMPT_INJECTION]: The skill defines a standard interface for image generation that accepts a user-providedpromptstring. This creates a surface for indirect prompt injection common to text-to-image tools. - Ingestion points: The
promptfield in thePOST /v1/images/generationsrequest body defined inSKILL.md. - Boundary markers: None present; the prompt is passed directly to the model provider.
- Capability inventory: Uses
curlandfetchto send data to external API endpoints for image generation. - Sanitization: No input validation or sanitization of the prompt content is specified in the skill file.- [COMMAND_EXECUTION]: The skill provides examples of using
curlandfetchto interact with its API, which is standard behavior for a tool of this type.
Audit Metadata