skills/hairyf/skills/imagine/Gen Agent Trust Hub

imagine

Pass

Audited by Gen Agent Trust Hub on Aug 11, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a Node.js script (scripts/imagine.js) intended to be executed via the CLI by the agent. This is the primary purpose of the skill and provides a structured interface for image generation through OpenAI, Gemini, and SiliconFlow APIs.
  • [EXTERNAL_DOWNLOADS]: The script fetches generated images from provider APIs (OpenAI, Google, SiliconFlow) and downloads them to the local disk. These are expected operations for an image generation utility.
  • [DATA_EXFILTRATION]: The skill implements a zero-dependency HTTP client in scripts/lib/http.js that supports a CONNECT tunnel proxy. While this allows network communication, it is explicitly designed for accessing legitimate AI providers (like Gemini) from restricted networks (e.g., bypassing SNI resets/DNS pollution). The script only sends prompts and images to the configured API endpoints.
  • [CREDENTIALS_UNSAFE]: The documentation (references/core-setup.md) instructs users to store API keys in a .env file. The code uses scripts/lib/env.js to load these variables into the environment. This is a standard and safe practice for secret management in development tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 11, 2026, 06:27 AM
Security Audit — agent-trust-hub — imagine