image-generation
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface where user-provided input is used to construct API requests. \n
- Ingestion points: The
promptandaspectarguments inscripts/generate-image.tsare sourced from user input. \n - Boundary markers: Absent; user input is interpolated directly into the
fullPromptstring without delimiters. \n - Capability inventory: The script has the ability to write files to the local filesystem (
fs.writeFileSync) and perform network operations toopenrouter.ai(fetch). \n - Sanitization: No sanitization or validation is performed on the prompt input before it is sent to the remote model.
Audit Metadata