age-transformation
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external image data provided via URLs, which introduces a surface for instructions hidden within the data itself.
- Ingestion points: The
image_urlsparameter in the API request examples inSKILL.mdallows the agent to fetch and process arbitrary external images. - Boundary markers: The provided prompts lack explicit instructions to the AI model to ignore or separate any text-based instructions that might be present within the processed images (e.g., OCR-based injections).
- Capability inventory: The skill enables network operations via
curlto theeachsense-agent.core.eachlabs.runAPI endpoint and processes complex generation responses. - Sanitization: There is no evidence of validation or sanitization mechanisms for the content retrieved from the external image URLs before it is processed by the AI models.
Audit Metadata