brand-illustrate

Warn

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/illustrate.py to execute external image generation backends such as gpt-image-2 and nano-banana. The commands are constructed using arguments derived from user input and token files.\n- [REMOTE_CODE_EXECUTION]: The skill implements a discovery mechanism in scripts/illustrate.py (probe_backends) that searches for executable scripts in multiple locations, including environment variables (HUMANE_IMAGE_BACKEND, HUMANE_SKILLS_DIR), project-level configuration files (humane.json), and various agent-specific directories (e.g., ~/.claude/skills, ~/.codex/skills). It then executes the first matching file found, which involves running code from dynamically determined paths.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its prompt construction logic. \n
  • Ingestion points: Untrusted data enters the agent context through design.tokens.json files and user responses to a seven-step questionnaire (e.g., subject, purpose, style).\n
  • Boundary markers: The skill lacks explicit boundary markers or instructions to ignore embedded commands when interpolating data into the final generator prompt string.\n
  • Capability inventory: The skill has the capability to execute shell commands via subprocess.run using the generated prompts.\n
  • Sanitization: There is no sanitization or escaping of the user-provided content before it is interpolated into the prompts used for image generation.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 10, 2026, 09:33 PM
Security Audit — agent-trust-hub — brand-illustrate