dreamina-canvas-generate-image
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to execute the
dreamina-canvasCLI tool to perform operations such as creating, editing, and upscaling image nodes. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input via the
--promptparameter, which is interpolated into shell commands. This creates a surface where malicious prompt content could attempt to influence the agent or the underlying system. - Ingestion points: User-provided text strings identified by the
<prompt>placeholder inSKILL.mdandreferences/image-node-contract.md. - Boundary markers: No specific delimiters or instructions to ignore embedded commands within the prompt are provided.
- Capability inventory: Execution of the
dreamina-canvasCLI tool for image generation and node management. - Sanitization: There are no instructions for sanitizing or escaping the user-provided prompt before it is passed to the command line.
Audit Metadata