Skills
Navigate
skills/dlazy-ai/ecommerce-skills/fabric-on-body/Gen Agent Trust Hub

fabric-on-body

Pass

Audited by Gen Agent Trust Hub on Aug 31, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill scripts scripts/gen.mjs and scripts/lib/providers.mjs utilize child_process.spawn to execute the dlazy CLI tool (or a path specified in the DLAZY_BIN environment variable) to perform the primary generation tasks.
  • [DATA_EXFILTRATION]: The skill transmits local image data and user-provided prompts to external AI service providers, including OpenAI, Google Gemini, Fal, Replicate, and ByteDance Ark, as part of its core functionality.
  • [INDIRECT_PROMPT_INJECTION]: A vulnerability surface is present because the skill interpolates untrusted user-supplied data into prompt templates without sanitization.
  • Ingestion points: Prompt template placeholders in skill.md (e.g., [品类 + 版型描述]) and the --prompt argument in scripts/gen.mjs.
  • Boundary markers: Absent from the prompt templates.
  • Capability inventory: Execution of local commands via spawn, file system access (read/write), and network access via fetch.
  • Sanitization: No sanitization, escaping, or validation of user-provided input is implemented before prompt interpolation.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 31, 2026, 06:46 AM