image-generation

Pass

Audited by Gen Agent Trust Hub on May 6, 2026

Risk Level: SAFE
Full Analysis
  • [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface where user-provided input is used to construct API requests. \n
  • Ingestion points: The prompt and aspect arguments in scripts/generate-image.ts are sourced from user input. \n
  • Boundary markers: Absent; user input is interpolated directly into the fullPrompt string without delimiters. \n
  • Capability inventory: The script has the ability to write files to the local filesystem (fs.writeFileSync) and perform network operations to openrouter.ai (fetch). \n
  • Sanitization: No sanitization or validation is performed on the prompt input before it is sent to the remote model.
Audit Metadata
Risk Level
SAFE
Analyzed
May 6, 2026, 03:52 AM