article-image
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes several Bash and Python scripts (
gen-image.sh,gpt-image-2-gen.sh,extract_image.py) to interface with the Codex CLI and PicGo tool for image generation and extraction. - [EXTERNAL_DOWNLOADS]: The
gen-image.shscript includes logic to automatically install thepicgopackage from official Node.js registries (via npm, pnpm, yarn, or bun) if it is missing from the environment. - [CREDENTIALS_UNSAFE]: To facilitate image uploads, the skill synchronizes configuration from the PicGo GUI (
~/Library/Application Support/picgo/data.json) to the CLI configuration (~/.picgo/config.json). While this is necessary for the tool's function, it involves reading and writing configuration files that typically contain sensitive API tokens for image hosting services. - [DATA_EXFILTRATION]: The skill is designed to upload generated image files to external image hosting providers as configured by the user via the
picgotool. - [SAFE_PRACTICE]: The
extract_image.pyscript includes a strict validation function for output paths, preventing the skill from writing files to sensitive system directories (e.g.,/etc,/bin,/usr) and restricting file extensions to common image formats.
Audit Metadata