dreamina-canvas-generate-image

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill directs the agent to execute the dreamina-canvas CLI tool to perform operations such as creating, editing, and upscaling image nodes.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input via the --prompt parameter, which is interpolated into shell commands. This creates a surface where malicious prompt content could attempt to influence the agent or the underlying system.
  • Ingestion points: User-provided text strings identified by the <prompt> placeholder in SKILL.md and references/image-node-contract.md.
  • Boundary markers: No specific delimiters or instructions to ignore embedded commands within the prompt are provided.
  • Capability inventory: Execution of the dreamina-canvas CLI tool for image generation and node management.
  • Sanitization: There are no instructions for sanitizing or escaping the user-provided prompt before it is passed to the command line.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 02:20 AM