autoglm-generate-image
Fail
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: HIGHCREDENTIALS_UNSAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The file
generate-image.pycontains a hardcoded cryptographic secret (APP_KEY) used for generating MD5 signatures required by the API. - [COMMAND_EXECUTION]: The skill executes
generate-image.py, which utilizes theurllib.requestmodule to perform network requests to an external image generation service and a local token provider. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. Ingestion points:
sys.argv[1]ingenerate-image.py; Boundary markers: None; Capability inventory: network POST calls ingenerate-image.py; Sanitization: None (relying on standard JSON encoding for transport without validating content).
Recommendations
- AI detected serious security threats
Audit Metadata