skills/doany-ai/skills/image-edit/Gen Agent Trust Hub

image-edit

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute the runcomfy CLI tool to perform image edits based on user intent. This requires passing user-defined parameters into shell-executed commands.\n- [EXTERNAL_DOWNLOADS]: The skill requires installation of the @runcomfy/cli Node.js package. This is the official client for the RunComfy service mentioned in the documentation.\n- [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted user input that could influence the behavior of backend models.\n
  • Ingestion points: User-supplied prompt strings and image_urls / mask_image URLs are used as inputs for model execution.\n
  • Boundary markers: The instructions do not specify any delimiters to isolate user-supplied prompts from internal instructions when building the JSON payload.\n
  • Capability inventory: The skill uses the runcomfy CLI, which has the capability to download files to a local directory and communicate with external APIs.\n
  • Sanitization: The skill does not describe any methods for validating or sanitizing user-provided text or URLs before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 07:19 AM