image-stats
Pass
Audited by Gen Agent Trust Hub on Mar 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a temporary API key from a remote server (https://images.labnocturne.com/key) if the LABNOCTURNE_API_KEY environment variable is not set.
- [COMMAND_EXECUTION]: The skill executes curl commands to retrieve the API key and fetch storage statistics, and uses echo to inspect environment variables.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it displays the error message field from the API response directly to the user.
- Ingestion points: API response body processed in SKILL.md.
- Boundary markers: Absent.
- Capability inventory: Network access via curl.
- Sanitization: Absent.
Audit Metadata