puzzle-image-generator
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/generate_puzzle_image.jsfetches image data from Google's Gemini API (generativelanguage.googleapis.com). This is a well-known service and the activity is essential to the skill's purpose.\n- [COMMAND_EXECUTION]: The scriptscripts/generate_puzzle_image.jsperforms file system operations, including directory creation and file writing. It uses user-supplied arguments to determine the storage location.\n- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes external strings for command-line arguments.\n - Ingestion points: The
--prompt,--out, and--namearguments inscripts/generate_puzzle_image.jsare populated by the agent based on user requests.\n - Boundary markers: None; the script does not use delimiters to isolate these inputs.\n
- Capability inventory: The script has file write capabilities (
fs.writeFileSync) and network access (fetch) inscripts/generate_puzzle_image.js.\n - Sanitization: There is no validation or sanitization of the
--nameor--outarguments, which could lead to path traversal (e.g., writing to sensitive system directories) if malicious inputs are provided to the agent.
Audit Metadata