hermoso-product-photoshoot
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions involve running
npx -y hermoso, which downloads and executes a package from the NPM registry. This package is a vendor resource provided by the skill author to enable image generation and management. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted data by passing user-supplied image references and scene descriptions into CLI commands.
- Ingestion points: User-provided image paths, URLs, and descriptive prompts are used as arguments for the
hermoso generatecommand in SKILL.md. - Boundary markers: The skill does not explicitly define sanitization or boundary markers (such as specific delimiters) to separate user content from the CLI command structure.
- Capability inventory: The skill requires the
Bashtool to execute commands and interact with the filesystem and network via the Hermoso CLI. - Sanitization: No explicit input validation, escaping, or filtering is described in the skill instructions.
Audit Metadata