generate-cover-image
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: Orchestrates the cover generation process by executing local utility scripts for path resolution (cover-target.py), front matter updates (set-cover-frontmatter.py), and image processing (fetch-covers.sh).\n- [EXTERNAL_DOWNLOADS]: Downloads exported cover images from Canva using curl in the fetch-covers.sh script. The URLs are provided dynamically by the Canva connector tool.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes article content to synthesize image prompts, creating an attack surface for indirect prompt injection. Ingestion points: Article title, description, and body content accessed in SKILL.md. Boundary markers: Absent. Capability inventory: File system writes via set-cover-frontmatter.py, shell execution via fetch-covers.sh, and network access via the Canva connector. Sanitization: Absent.\n- [DATA_EXFILTRATION]: Transmits summarized article information to the Canva API via an integrated connector to generate background artwork. This is a functional requirement for image generation.
Audit Metadata