to-3d
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The documentation in references/model-flags.md contains directive language ("CRITICAL INSTRUCTION FOR AGENT") intended to guide the AI agent toward correctly executing tool commands.\n- [COMMAND_EXECUTION]: The skill executes a local command-line utility, dlazy, through scripts/lib/providers.mjs to perform image generation. The implementation utilizes node:child_process.spawn with an argument array, which prevents shell command injection vulnerabilities.\n- [EXTERNAL_DOWNLOADS]: The skill's scripts communicate with external AI service providers (including OpenAI, Google, Fal.ai, Replicate, and ByteDance) to process image data and may download image assets from remote URLs provided in user inputs.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests untrusted data from user-supplied image files and prompt strings.\n
- Ingestion points: Untrusted data enters via the --images (URLs/paths) and --prompt arguments processed in scripts/gen.mjs.\n
- Boundary markers: None observed in the prompt interpolation logic.\n
- Capability inventory: The skill has access to local file read/write operations, network requests to AI APIs, and shell command execution via dlazy.\n
- Sanitization: Arguments are passed to the spawn process as an array, avoiding shell interpolation risks.
Audit Metadata