image
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides standard command-line snippets for image optimization and processing, such as
cwebp,mogrify, andjpegoptim. It also includes acurlutility command for checking image sources on a webpage and mentions thescreencaptureCLI for macOS. - [EXTERNAL_DOWNLOADS]: The skill references and provides links to several well-known AI image generation and design services, including Google Gemini, OpenAI, Flux (Black Forest Labs), Ideogram, and Canva. These are recognized as legitimate services for the skill's intended purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest context from local product marketing files, creating a potential surface for indirect prompt injection if those files contain untrusted content.
- Ingestion points: Reads
.agents/product-marketing.md,.claude/product-marketing.md, andproduct-marketing-context.mdto gather marketing context. - Boundary markers: None identified in the instructions.
- Capability inventory: Executes local commands for image optimization and performs network requests via
curlto analyze web pages. - Sanitization: None identified; the skill assumes the context files contain valid marketing information.
Audit Metadata