clothing-detail
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Node.js wrapper script (
gen.mjs) that executes thedlazycommand-line utility usingchild_process.spawn. This allows the agent to generate images by passing user-defined parameters to the CLI in a controlled manner. - [EXTERNAL_DOWNLOADS]: The skill facilitates network requests to multiple established AI providers, including OpenAI, Google Gemini, Fal.ai, Replicate, and ByteDance Ark, as well as the vendor's own infrastructure at
api.dlazy.comandfiles.dlazy.com. These interactions are transparently documented as necessary for the image generation functionality. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user prompts, brand configuration files, and external image URLs, which are interpolated into requests for AI models. Ingestion points: CLI arguments in
gen.mjsand YAML files inbrand.mjs. Boundary markers: None implemented. Capability inventory: Execution of system commands and network requests to external APIs. Sanitization: The skill does not perform specific filtering or escaping of the prompt content, which is typical for this type of generative tool.
Audit Metadata