xai-grok-imagine-image
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements exemplary security measures for handling external image artifacts. The provided Python examples include a
download_xai_assetfunction that enforces an HTTPS-only allowlist for hostnames, limits and validates redirects, and explicitly omits API credentials during asset retrieval to prevent token leakage. - [SAFE]: Data integrity and safety are maintained through multiple layers of verification. The skill checks MIME types against file signatures (magic bytes), uses strict base64 decoding, and utilizes the Pillow library with explicit pixel-count limits (
MAX_IMAGE_PIXELS) to mitigate image-based denial-of-service or exploit attempts. - [SAFE]: Credential handling follows best practices, instructing the use of environment variables or secret managers while warning against hardcoding keys in source code, logs, or asset metadata.
- [SAFE]: The documentation includes a thorough section on acceptable use, privacy, and data rights, emphasizing compliance with xAI's terms and the need for human review in consequential use cases.
Audit Metadata