gpt-image-2-gen
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a shell script (
gpt-image-gen.sh) and a Node.js CLI installer (bin/cli.js) to perform system checks and execute API requests. These tools are used legitimately for tasks such as verifying the availability ofcurlandjq, installing skill files, and communicating with the EvoLink image generation service. - [DATA_EXPOSURE]: The CLI installer offers to store the
EVOLINK_API_KEYin shell profile files (e.g.,.bashrc,.zshrc) to ensure the agent has access to the service across sessions. This is a common developer tool pattern and the script explicitly prompts the user for confirmation before appending any data to sensitive configuration files. - [EXTERNAL_DOWNLOADS]: The skill interacts with
api.evolink.aifor image generation, task polling, and account balance verification. All network activity is directed to the vendor's official domain, and parameters are safely handled usingjqto prevent command or payload injection. - [OBFUSCATION]: A static detector flag for homoglyphs in
README.mdwas evaluated and found to be a false positive. The flag was triggered by localized language descriptors and regional emojis (e.g., flags for language selection) used in the project's documentation. No malicious obfuscation or hidden logic was found.
Audit Metadata