draw-image
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the execution of multiple Python scripts included with the package, specifically
automcm-pro-runtime/bootstrap_runtime.pyandscripts/draw_image.py. - [PERSISTENCE]: The instructions include modifying the user's shell profile (
~/.bashrc) to persist theOPENAI_API_KEYenvironment variable. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
openaipackage from the official Python Package Index (PyPI). - [INDIRECT_PROMPT_INJECTION]: The skill takes user-provided text as input for the
--promptargument, which is then passed to an external LLM for image generation, creating an attack surface for indirect prompt injection.
Audit Metadata