ai-product-photography
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references an external installation script and instructions hosted on GitHub:
https://raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.md. This is used to set up the necessary CLI tool for the skill's functionality. - [INDIRECT_PROMPT_INJECTION]: The provided batch generation Bash script example is susceptible to command injection if user-provided variables (
PRODUCT,angle) contain shell metacharacters. - Ingestion points: User-defined variables in the
Batch Generationsection of SKILL.md. - Boundary markers: None; variables are interpolated directly into the command string.
- Capability inventory: The skill uses the
Bashtool to executebeltcommands. - Sanitization: None present in the provided shell script snippet.
Audit Metadata