wenqu-image

Pass

Audited by Gen Agent Trust Hub on Aug 5, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads style reference images from the gogoingai/wenqu-skills repository on GitHub using the fetch-ref.sh script. These downloads are limited to assets required for image generation.
  • [COMMAND_EXECUTION]: The skill spawns local processes including Bun, Bash, and Python3 to execute its internal scripts (image-cli, fetch-ref.sh, extract_image.py). It also interacts with the codex and picgo CLI tools to perform image generation and uploading.
  • [CREDENTIALS_UNSAFE]: The skill implements a secure handling mechanism for API keys. It instructs users to store secrets in a dedicated .env file within the user's home directory (~/.gogoingai/wenqu-skills/image/.env) and includes logic to enforce strict file permissions (chmod 600), refusing to load secrets if they are world-readable.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 5, 2026, 08:31 AM
Security Audit — agent-trust-hub — wenqu-image