eachlabs-product-visuals

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-supplied prompts and image URLs, which are then transmitted to EachLabs AI models. This setup creates a surface for indirect prompt injection attacks, where malicious instructions embedded in the input data could potentially influence the behavior or output of the AI generation process.
  • Ingestion points: Found in SKILL.md and references/MODELS.md within parameters such as prompt, image_urls, scene_description, image, and product_name.
  • Boundary markers: Absent. There are no explicit delimiters or instructions to the model to ignore potential commands embedded within the provided data.
  • Capability inventory: The skill demonstrates capabilities for network communication using curl to interact with the EachLabs API as described in SKILL.md.
  • Sanitization: Absent. The skill does not define validation or sanitization routines for the input data before processing.
  • [COMMAND_EXECUTION]: The documentation provides multiple curl command examples to demonstrate how an agent should interact with the EachLabs prediction API. These commands utilize standard headers and JSON payloads to communicate with the vendor's infrastructure.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 05:55 AM