image
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides example shell commands for image optimization using standard command-line utilities such as
cwebp,mogrify(ImageMagick), andjpegoptim. - [COMMAND_EXECUTION]: Includes a
curlandgrepcommand chain intended to extract image source tags from external websites for auditing purposes. - [EXTERNAL_DOWNLOADS]: References the
@vercel/ogpackage, which is an official and well-known library for generating dynamic social preview images, maintained by a trusted organization (Vercel). - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an ingestion surface for untrusted content.
- Ingestion points: Loads project context from
.agents/product-marketing-context.mdand fetches HTML content from user-specified URLs viacurl. - Boundary markers: No explicit delimiters or instructions are provided to the agent to disregard embedded directives in the fetched content.
- Capability inventory: The agent has access to shell execution (
curl,mogrify), local file reads, and image generation API tools. - Sanitization: There is no mention of sanitizing or validating the output of the
curlorgrepoperations before they are processed by the agent. - [SAFE]: All external tools, APIs (Google Gemini, OpenAI, Ideogram, Black Forest Labs), and services (Canva, Figma) mentioned are well-known or trusted industry standards used according to their primary purpose.
Audit Metadata