material-enhancement
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [SAFE]: The skill implements a robust framework for ecommerce image generation, utilizing standard Node.js practices for environment variable management and command-line tool integration.
- [COMMAND_EXECUTION]: The skill uses
child_process.spawnto interface with thedlazyCLI. This execution is performed safely using argument arrays rather than raw shell strings, which mitigates command injection risks. - [EXTERNAL_DOWNLOADS]: The scripts include functionality to fetch images from remote URLs and interact with established AI service providers (OpenAI, Google Gemini, Fal, Replicate, and Volcano Engine Ark). These connections target well-known domains or the vendor's own infrastructure.
- [CREDENTIALS_UNSAFE]: API keys are managed through standard environment variables, ensuring that sensitive secrets are not hardcoded within the skill's source code.
Audit Metadata