baoyu-image-gen
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes external tools like
curlandcodexusing safe APIs (execFileSync,spawn). These tools are used for handling API requests and image generation tasks, which is consistent with the skill's primary purpose.\n- [EXTERNAL_DOWNLOADS]: The skill connects to official, well-known AI service providers (OpenAI, Google, Azure, Replicate, etc.) to perform image generation and retrieve the results. These operations target trusted service domains.\n- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes user-provided prompt files and concatenates them for API requests. However, this is inherent to the functionality of an image generation tool.\n - Ingestion points: User-provided strings via
--promptand file content via--promptfiles(scripts/main.ts).\n - Boundary markers: Absent.\n
- Capability inventory: Network operations for API calls (fetch/curl) and file system writes to save images.\n
- Sanitization: No significant sanitization is performed on the prompt text before transmission.
Audit Metadata