brand-illustrate
Warn
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runinscripts/illustrate.pyto execute external image generation backends such asgpt-image-2andnano-banana. The commands are constructed using arguments derived from user input and token files.\n- [REMOTE_CODE_EXECUTION]: The skill implements a discovery mechanism inscripts/illustrate.py(probe_backends) that searches for executable scripts in multiple locations, including environment variables (HUMANE_IMAGE_BACKEND,HUMANE_SKILLS_DIR), project-level configuration files (humane.json), and various agent-specific directories (e.g.,~/.claude/skills,~/.codex/skills). It then executes the first matching file found, which involves running code from dynamically determined paths.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its prompt construction logic. \n - Ingestion points: Untrusted data enters the agent context through
design.tokens.jsonfiles and user responses to a seven-step questionnaire (e.g., subject, purpose, style).\n - Boundary markers: The skill lacks explicit boundary markers or instructions to ignore embedded commands when interpolating data into the final generator prompt string.\n
- Capability inventory: The skill has the capability to execute shell commands via
subprocess.runusing the generated prompts.\n - Sanitization: There is no sanitization or escaping of the user-provided content before it is interpolated into the prompts used for image generation.
Audit Metadata