depth-map-generation
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes multiple examples of shell commands using
curlto interact with the EachLabs API ateachsense-agent.core.eachlabs.run. These are standard technical documentation patterns for demonstrating API usage. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources by accepting image URLs in its API request examples. This creates an attack surface where a maliciously crafted image could attempt to influence the AI's behavior, although the specialized task of depth estimation significantly limits the risk of successful exploitation.
- Ingestion points: The
image_urlsparameter in the API request body found inSKILL.md(e.g., Use Case Examples 1 through 10). - Boundary markers: Absent; the instructions and image URLs are part of the same structured JSON payload without explicit delimiters.
- Capability inventory: Network requests to
https://eachsense-agent.core.eachlabs.runas documented inSKILL.md. - Sanitization: Absent; the provided examples pass external URLs directly into the API request payload without validation or filtering.
Audit Metadata