tzai-ui
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill dynamically locates an engine script (tzai-image) by checking several predefined paths in the user's home directory.
- [COMMAND_EXECUTION]: It executes the located script using bash to perform the image generation task.
- [EXTERNAL_DOWNLOADS]: The skill provides a suggested command to install the required dependency using npx from the vendor's repository if not found locally.
- [INDIRECT_PROMPT_INJECTION]: User input is used to compile a visual brief passed as an argument to a shell command. Ingestion: User input; Boundaries: Double quotes around prompt argument; Capabilities: Shell execution of local script; Sanitization: Relies on agent to safely compile input.
Audit Metadata