image

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides standard command-line snippets for image optimization and processing, such as cwebp, mogrify, and jpegoptim. It also includes a curl utility command for checking image sources on a webpage and mentions the screencapture CLI for macOS.
  • [EXTERNAL_DOWNLOADS]: The skill references and provides links to several well-known AI image generation and design services, including Google Gemini, OpenAI, Flux (Black Forest Labs), Ideogram, and Canva. These are recognized as legitimate services for the skill's intended purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest context from local product marketing files, creating a potential surface for indirect prompt injection if those files contain untrusted content.
  • Ingestion points: Reads .agents/product-marketing.md, .claude/product-marketing.md, and product-marketing-context.md to gather marketing context.
  • Boundary markers: None identified in the instructions.
  • Capability inventory: Executes local commands for image optimization and performs network requests via curl to analyze web pages.
  • Sanitization: None identified; the skill assumes the context files contain valid marketing information.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 08:11 PM