generate-image
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill interacts with openrouter.ai, which is a well-known service for accessing AI models. This communication is required for the primary function of the skill.
- [DATA_EXPOSURE]: The script searches for and reads an 'OPENROUTER_API_KEY' from '.env' files in the directory tree. This is a standard and safe practice for secret management compared to hardcoding credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text and images as inputs for image generation.
- Ingestion points: Text prompts provided via CLI arguments and image files provided via the --input flag in
scripts/generate_image.py. - Boundary markers: None used; the prompt is passed directly into the API request payload.
- Capability inventory: Performs network POST requests to an external API and writes binary image data to the local file system.
- Sanitization: No input sanitization is performed on the prompt. However, because the resulting output is a static image file, the risk of the data content influencing the agent's internal logic is negligible.
Audit Metadata