generate-image

Warn

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Persistence mechanism detected. The skill instructions the agent to write API keys to shell profile files (e.g., .bashrc, .zshrc). This involves modifying system-level configuration files to ensure the environment variables are available in future sessions.\n- [CREDENTIALS_UNSAFE]: The workflow involves requesting, using, and storing sensitive API keys (SKILL_IMAGE_GEN_OPENAI_KEY and SKILL_IMAGE_GEN_GEMINI_KEY). Although the keys are provided by the user, the skill manages their persistent storage in plaintext configuration files.\n- [EXTERNAL_DOWNLOADS]: The skill communicates with well-known API endpoints from OpenAI (api.openai.com) and Google (generativelanguage.googleapis.com) to generate and retrieve image data.\n- [PROMPT_INJECTION]: The skill interpolates user-provided text directly into JSON request bodies. This creates a potential surface for indirect prompt injection or schema confusion if the user input is not properly handled, although the instructions include a guideline for escaping special characters.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 15, 2026, 09:10 AM
Security Audit — agent-trust-hub — generate-image