image
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a standard instructional guide for marketing visual production, providing legitimate workflows and referencing official resources from established technology vendors.
- [COMMAND_EXECUTION]: The documentation includes common shell commands for image optimization using utilities such as
cwebp,mogrify, andjpegoptim. It also provides acurlsnippet to inspect image source tags on a webpage. These are standard tools used appropriately for the skill's stated purpose. - [EXTERNAL_DOWNLOADS]: The skill references and links to official developer platforms and pricing pages for well-known services including Google Gemini, Black Forest Labs (Flux), Ideogram, OpenAI, and Recraft.
- [PROMPT_INJECTION]:
- Ingestion points: The skill recommends reading project context from local files like
.agents/product-marketing.mdand fetches HTML content from user-provided URLs usingcurl. - Boundary markers: There are no explicit instructions or delimiters provided to the agent to ignore potentially malicious instructions embedded within these external data sources.
- Capability inventory: The skill environment allows for shell command execution and network fetching via
curl. - Sanitization: No specific validation or filtering logic is described for the data ingested from the context files or the remote URL content.
Audit Metadata