AI Image Generator & Editor — GPT Image 2, Nanobanana, ComfyUI

Pass

Audited by Gen Agent Trust Hub on Apr 30, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill retrieves and executes the meigen package at a pinned version (1.2.13) from the npm registry using npx. This package is the core functional component of the skill and is maintained by the author.
  • [CREDENTIALS_UNSAFE]: The documentation provides explicit guidance on securing API tokens for the various supported providers, recommending the use of environment variables or configuration files with restricted file permissions (chmod 600). No hardcoded secrets or credentials were found in the source files.
  • [PROMPT_INJECTION]: The skill features a capability to fetch prompts from an external gallery and interpolate them into image generation requests, creating an indirect injection surface.
  • Ingestion points: External prompt data retrieved through the search_gallery tool from meigen.ai.
  • Boundary markers: None identified in the instruction text to delimit external content from system instructions.
  • Capability inventory: Subprocess execution via npx, network requests to remote image generation APIs, and local file system write access for saving generated images.
  • Sanitization: Not explicitly documented; the skill relies on the underlying MCP server's implementation.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 30, 2026, 05:32 PM
Security Audit — agent-trust-hub — AI Image Generator & Editor — GPT Image 2, Nanobanana, ComfyUI