gpt-image-2-gen

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a shell script (gpt-image-gen.sh) and a Node.js CLI installer (bin/cli.js) to perform system checks and execute API requests. These tools are used legitimately for tasks such as verifying the availability of curl and jq, installing skill files, and communicating with the EvoLink image generation service.
  • [DATA_EXPOSURE]: The CLI installer offers to store the EVOLINK_API_KEY in shell profile files (e.g., .bashrc, .zshrc) to ensure the agent has access to the service across sessions. This is a common developer tool pattern and the script explicitly prompts the user for confirmation before appending any data to sensitive configuration files.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with api.evolink.ai for image generation, task polling, and account balance verification. All network activity is directed to the vendor's official domain, and parameters are safely handled using jq to prevent command or payload injection.
  • [OBFUSCATION]: A static detector flag for homoglyphs in README.md was evaluated and found to be a false positive. The flag was triggered by localized language descriptors and regional emojis (e.g., flags for language selection) used in the project's documentation. No malicious obfuscation or hidden logic was found.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 09:46 AM
Security Audit — agent-trust-hub — gpt-image-2-gen