gpt-image-2

Pass

Audited by Gen Agent Trust Hub on Aug 12, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The main script scripts/gpt_image_2.py utilizes subprocess.run to execute magick (ImageMagick) for image resizing and generating contact sheets. These calls are implemented using argument lists rather than shell strings, which mitigates command injection risks. Parameters like image dimensions are retrieved from a local platforms.yaml configuration file.
  • [COMMAND_EXECUTION]: Instructions in SKILL.md direct the agent to use standard system utilities (osascript, xclip) for clipboard interaction and (open, xdg-open) for file previewing. These operations are within the expected scope of an interactive utility for managing local assets.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with official endpoints for OpenAI and OpenRouter to facilitate image generation. These network operations target well-known services and are essential for the skill's functionality.
  • [SAFE]: The skill implements best practices for secret management by retrieving API keys from environment variables rather than hardcoding them. It also maintains a local log of activity in the user's configuration directory.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 12, 2026, 02:11 PM
Security Audit — agent-trust-hub — gpt-image-2