image-ad-clone
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local Python scripts (
generate_image.py) found in specified paths, including the user's home directory (~/.claude/skills/) and the current repository, to validate generated templates. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to extract verbatim text from external images and persist it into a shared library, which could allow maliciously crafted text in an image to influence the agent's behavior or poison the template library.
- Ingestion points: External reference images provided as input (Phase 1 and Phase 2).
- Boundary markers: Absent. The instructions do not specify any delimiters or warnings to ignore embedded commands within the extracted image text.
- Capability inventory: The skill possesses the capability to write to the file system (appending to
shared/skills/image-ad-prompting/prompting/prompt-library.md) and execute shell commands via Python scripts (generate_image.py). - Sanitization: Absent. The workflow explicitly requires extracting "every text string verbatim" without filtering or validation of the content's intent.
Audit Metadata