dreamina-cli-text2image
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill documentation includes an installation command that fetches and executes a shell script from a remote URL (
curl -fsSL https://jimeng.jianying.com/cli | bash). This URL corresponds to the official domain of the service the skill is designed to support. - [COMMAND_EXECUTION]: The skill instructs the agent to perform local command-line operations using the
dreaminautility to interact with generative models and manage sessions. - [INDIRECT_PROMPT_INJECTION]: The skill acts as a wrapper for generative tasks where user-provided prompts are interpolated into shell commands, creating an injection surface.
- Ingestion points: The
--promptparameter indreamina text2imagecommands throughout the skill instructions and examples. - Boundary markers: Commands demonstrated in the skill use standard shell quoting (double quotes), but there are no specific instructions for the agent to sanitize or escape user-provided strings beyond this.
- Capability inventory: The agent can execute shell commands and perform network-based image generation tasks via the CLI.
- Sanitization: The instructions do not define explicit sanitization logic for user input.
Audit Metadata