wenqu-image
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads style reference images from the gogoingai/wenqu-skills repository on GitHub using the
fetch-ref.shscript. These downloads are limited to assets required for image generation. - [COMMAND_EXECUTION]: The skill spawns local processes including Bun, Bash, and Python3 to execute its internal scripts (
image-cli,fetch-ref.sh,extract_image.py). It also interacts with thecodexandpicgoCLI tools to perform image generation and uploading. - [CREDENTIALS_UNSAFE]: The skill implements a secure handling mechanism for API keys. It instructs users to store secrets in a dedicated
.envfile within the user's home directory (~/.gogoingai/wenqu-skills/image/.env) and includes logic to enforce strict file permissions (chmod 600), refusing to load secrets if they are world-readable.
Audit Metadata