skills/inference-sh/skills/qwen-image/Gen Agent Trust Hub

qwen-image

Pass

Audited by Gen Agent Trust Hub on Mar 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute infsh CLI commands for image generation and task automation. This is the intended functionality provided by the vendor.
  • [EXTERNAL_DOWNLOADS]: The documentation references the installation of the inference-sh/skills package via npx and fetches image assets from cloud.inference.sh. These resources are managed by the skill's author and are considered safe.
  • [PROMPT_INJECTION]: The skill processes user-provided descriptions via the prompt and reference_images parameters which are then passed to the infsh CLI tool.
  • Ingestion points: Data enters via the prompt and reference_images fields in the infsh app run input.
  • Boundary markers: None explicitly defined; the skill relies on JSON structure for input passing.
  • Capability inventory: Bash(infsh *) is used for interaction with the inference.sh platform.
  • Sanitization: The skill relies on the agent's tool-call formatting to ensure prompt safety.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 8, 2026, 11:52 PM
Security Audit — agent-trust-hub — qwen-image