generate-image

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill interacts with openrouter.ai, which is a well-known service for accessing AI models. This communication is required for the primary function of the skill.
  • [DATA_EXPOSURE]: The script searches for and reads an 'OPENROUTER_API_KEY' from '.env' files in the directory tree. This is a standard and safe practice for secret management compared to hardcoding credentials.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text and images as inputs for image generation.
  • Ingestion points: Text prompts provided via CLI arguments and image files provided via the --input flag in scripts/generate_image.py.
  • Boundary markers: None used; the prompt is passed directly into the API request payload.
  • Capability inventory: Performs network POST requests to an external API and writes binary image data to the local file system.
  • Sanitization: No input sanitization is performed on the prompt. However, because the resulting output is a static image file, the risk of the data content influencing the agent's internal logic is negligible.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 02:40 PM