wenqu-image
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads style reference images from the author's GitHub repository to provide visual context for the image generation process. These downloads are performed on-demand and stored in a local cache.\n- [COMMAND_EXECUTION]: The skill utilizes several command-line tools, including the Codex CLI for generating images and PicGo for managing uploads. It also uses common system utilities like curl for asset retrieval and openssl for generating unique filenames.\n- [DATA_EXFILTRATION]: As part of its intended functionality, the skill uploads generated images to external image beds using the user's PicGo configuration.\n- [CREDENTIALS_UNSAFE]: The environment setup script synchronizes configuration data for the PicGo utility between local directories. While these files may contain authentication tokens, the operation is restricted to the user's local environment.\n- [PROMPT_INJECTION]: The skill constructs model prompts by interpolating user-supplied descriptions. While necessary for operation, this process lacks explicit boundary markers for user-controlled content, creating a potential surface for indirect instruction injection.
Audit Metadata