giggle-generation-image

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill operates by executing a local Python script (scripts/generation_api.py) to communicate with the vendor's image generation service.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-supplied text prompts and external image URLs for its core image-to-image and text-to-image functions.
  • Ingestion points: The --prompt and --reference-images arguments in scripts/generation_api.py are the primary entry points for untrusted data.
  • Boundary markers: The skill does not currently define explicit delimiters or instructions for the agent to segregate user-supplied content from system commands when constructing API calls.
  • Capability inventory: The skill utilizes the requests library to perform network operations to giggle.pro and includes a download_images function capable of writing files to the local ~/Downloads directory.
  • Sanitization: The scripts/generation_api.py script performs format validation on reference image inputs (ensuring they are valid URLs, asset IDs, or Base64 strings) before processing them.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 03:28 AM