qwen-image-pro
Pass
Audited by Gen Agent Trust Hub on Mar 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
infshCLI tool to interact with the image generation service. This tool is provided by the vendor and used as intended for service interaction. - [EXTERNAL_DOWNLOADS]: The skill references the
inferenceshPython library and theinference-sh/skillspackage for installation. These are official vendor-managed resources. - [PROMPT_INJECTION]: The skill accepts user-defined prompts for image generation, creating a surface for indirect prompt injection.
- Ingestion points: The
promptparameter in theinfsh app runbash command and Python SDK calls. - Boundary markers: No specific boundary markers or escape sequences are implemented for the prompt string.
- Capability inventory: The skill possesses the
Bash(infsh *)capability to send input to a remote AI model. - Sanitization: The skill does not perform local sanitization of the input prompt.
Audit Metadata