generate-graphic
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes user-supplied subjects and local brand profile files (color-system.json, typography.json, visual-identity.md) to construct instructions for external image models. This creates a surface for indirect prompt injection where malicious input could influence the generation process. • Ingestion points: Local brand files and user arguments. • Capability inventory: Local Node.js script execution and network access to image APIs. • Sanitization: Warnings for text rendering requests.
- [SAFE]: The skill employs secure credential management, reading API keys from environment variables and transmitting them via headers rather than URLs or persistent storage.
- [SAFE]: All network operations are protected by an explicit opt-in requirement via the BRAND_FORGE_RASTER environment variable.
Audit Metadata