emoji-sticker-generation
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data, specifically user-provided prompts and external image URLs, which are then passed to the EachLabs API for processing.
- Ingestion points: External image URLs provided in the
image_urlsfield and user-defined text in themessagesarray withinSKILL.mdexamples. - Boundary markers: The current instructions and examples do not implement explicit delimiters (e.g., triple backticks or XML tags) or specific instructions to the model to ignore embedded commands within the input data.
- Capability inventory: The skill utilizes network capabilities to communicate with the EachLabs API (
eachlabs.runandeachlabs.ai) to generate and retrieve media files. - Sanitization: There is no evidence of input validation or URL sanitization for the image sources within the provided documentation.
Audit Metadata