creative-image-generator
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
google-generativeaiPython package. This is the official SDK provided by Google for interacting with Gemini models and is a standard requirement for this functionality. - [COMMAND_EXECUTION]: The skill defines a workflow utilizing MCP tools
generate_creative_imageandexpand_to_stories. These tools are used for image generation and outpainting, which is the primary purpose of the skill. - [DATA_EXFILTRATION]: The skill accesses local files located in
.claude/ads-agent/config/to retrieve account information and advertisement briefs. This data is used to populate parameters for the image generation tool, which sends data to Google's API as intended by the user request. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes external data from Markdown brief files.
- Ingestion points:
.claude/ads-agent/config/briefs/{account}.mdand user-provided text. - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the interpolation logic.
- Capability inventory: Includes image generation (
generate_creative_image) and file reading (Read tool). - Sanitization: There is no evidence of sanitization or validation of the content read from the brief files before it is passed to the generation tool.
Audit Metadata