gpt-image-2-gen

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow is the user/agent-provided prompt and optional --image reference URLs passed into scripts/gpt-image-gen.sh, where the script builds and sends prompt/image_urls into the generation request and then polls task results for IMAGE_URL= outputs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's install instructions tell agents to fetch and run remote code (e.g., git clone / openclaw install) from https://github.com/EvoLinkAI/gpt-image-2-gen-skill (and the .git variant), which will download and execute external code at runtime.