qwen-image
Pass
Audited by Gen Agent Trust Hub on Mar 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to executeinfshCLI commands for image generation and task automation. This is the intended functionality provided by the vendor. - [EXTERNAL_DOWNLOADS]: The documentation references the installation of the
inference-sh/skillspackage vianpxand fetches image assets fromcloud.inference.sh. These resources are managed by the skill's author and are considered safe. - [PROMPT_INJECTION]: The skill processes user-provided descriptions via the
promptandreference_imagesparameters which are then passed to theinfshCLI tool. - Ingestion points: Data enters via the
promptandreference_imagesfields in theinfsh app runinput. - Boundary markers: None explicitly defined; the skill relies on JSON structure for input passing.
- Capability inventory:
Bash(infsh *)is used for interaction with the inference.sh platform. - Sanitization: The skill relies on the agent's tool-call formatting to ensure prompt safety.
Audit Metadata