tzai-food
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill implements a search routine to locate an executable script named 'tzai-image' across several standard agent-skill directories in the user's home folder (e.g.,
~/.agents/,~/.claude/,~/.cursor/). If found, it executes this script usingbash. - [COMMAND_EXECUTION]: The skill interpolates user-provided text directly into a shell command:
bash "$ENGINE" food --prompt "<user subject>". This pattern presents a potential command injection surface if the user-supplied '' contains shell metacharacters that are not correctly escaped or handled by the underlying engine script. - [EXTERNAL_DOWNLOADS]: If the required engine is not found, the skill prompts the user to download and install the dependency using
npx skills add kedoupi/tzai-image-skill. This dependency originates from the same author ('kedoupi') and is a standard part of the tool's ecosystem.
Audit Metadata