giggle-generation-image
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill operates by executing a local Python script (
scripts/generation_api.py) to communicate with the vendor's image generation service. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-supplied text prompts and external image URLs for its core image-to-image and text-to-image functions.
- Ingestion points: The
--promptand--reference-imagesarguments inscripts/generation_api.pyare the primary entry points for untrusted data. - Boundary markers: The skill does not currently define explicit delimiters or instructions for the agent to segregate user-supplied content from system commands when constructing API calls.
- Capability inventory: The skill utilizes the
requestslibrary to perform network operations togiggle.proand includes adownload_imagesfunction capable of writing files to the local~/Downloadsdirectory. - Sanitization: The
scripts/generation_api.pyscript performs format validation on reference image inputs (ensuring they are valid URLs, asset IDs, or Base64 strings) before processing them.
Audit Metadata