Skills
Navigate
skills/full-aigc-skills/baoyu-skills/baoyu-image-gen/Gen Agent Trust Hub

baoyu-image-gen

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses execFileSync to run curl in scripts/providers/google.ts and spawn to run the codex CLI in scripts/providers/codex-cli.ts. These executions are necessary for the skill core networking and integration features and target trusted services.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided prompts and images to generate AI content.\n
  • Ingestion points: Data enters via --prompt, --promptfiles, and --ref flags parsed in scripts/main.ts.\n
  • Boundary markers: The skill uses delimiters like 'PROMPT:' and 'TASK:' in the codex-cli provider to isolate user data.\n
  • Capability inventory: The skill possesses file-write and network capabilities.\n
  • Sanitization: scripts/codex-imagegen/main.ts employs assertSafePath to mitigate shell injection risks in file paths.\n- [DYNAMIC_EXECUTION]: scripts/main.ts dynamically imports local provider modules. This behavior is safely limited to a predefined list of provider identifiers.\n- [EXTERNAL_DOWNLOADS]: The skill downloads generated media from well-known AI providers, including Google, OpenAI, Alibaba, and others, as part of its intended image generation workflow.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 07:47 AM
Security Audit — agent-trust-hub — baoyu-image-gen