tzai-architecture
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill identifies and executes a local script named
tzai-imagelocated in several possible hidden directories within the user's home folder. - [EXTERNAL_DOWNLOADS]: The skill suggests the installation of a secondary component (
kedoupi/tzai-image-skill) from an external source if the core engine is missing. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by passing user input directly into a bash command string.
- Ingestion points: User-provided text for the image subject is interpolated into the
--promptflag of a bash command inSKILL.md. - Boundary markers: The skill does not employ delimiters or ignore-instructions to isolate user input from the rest of the command.
- Capability inventory: The skill possesses the capability to execute shell scripts with arbitrary arguments.
- Sanitization: There is no logic provided within the skill to sanitize or escape special shell characters in the user input.
Audit Metadata