gpt-image-2-gen
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were detected. The skill performs its stated function of image generation using a remote API without any malicious secondary behaviors.- [EXTERNAL_DOWNLOADS]: The skill interacts with the official EvoLink API (api.evolink.ai) via curl and provides an npm-based installer (npx evolink-gpt-image). These downloads and network operations are restricted to the vendor's own infrastructure and well-known registries.- [COMMAND_EXECUTION]: The skill uses a Bash script to handle API requests. The script securely constructs JSON payloads using jq, which mitigates the risk of command injection from user-provided prompts.- [CREDENTIALS_UNSAFE]: The installation CLI provides a prompt-based setup for the EVOLINK_API_KEY. It optionally appends the key to shell profile files (~/.bashrc, ~/.zshrc) after user confirmation. This is a standard configuration practice for CLI-based agent skills.- [OBFUSCATION]: A homoglyph warning was evaluated but determined to be a false positive triggered by flag emojis in the translation menu of the README. No malicious character substitution was found.
Audit Metadata