adobe-core-workflow-a
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill communicates with official Adobe Firefly API endpoints (
firefly-api.adobe.io). These represent well-known services and do not involve unauthorized data transmission. - [SAFE]: Authentication is handled via a secure pattern, using environment variables for client identifiers and an external access token retriever, avoiding hardcoded secrets.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the agent or user to generate or modify images, which creates an attack surface for indirect prompt injection.
- Ingestion points: Function arguments
prompt,imageUrl, andmaskUrlin the TypeScript source snippets inSKILL.md. - Boundary markers: Input data is encapsulated within JSON request bodies sent to the Firefly API.
- Capability inventory: Network operations via
fetchto external API services. - Sanitization: The skill relies on standard JSON serialization for data interpolation.
Audit Metadata