skills/lora-sys/skills/lora-visual/Gen Agent Trust Hub

lora-visual

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local Python scripts, scripts/cutout.py and scripts/validate_mode_b.py, to perform background removal (chroma-keying) and image quality validation. These operations are confined to the agent's local environment and are used to manage project assets.
  • [EXTERNAL_DOWNLOADS]: The skill requires the Pillow (PIL) Python library for image manipulation. This is a well-known, standard library in the Python ecosystem and is appropriate for the skill's stated purpose.
  • [DYNAMIC_EXECUTION]: The test suite located in tests/test_validate_mode_b.py utilizes importlib.util to dynamically load the validation script for unit testing purposes. This is a standard developer practice for testing local modules and does not present a security risk within the context of the skill's execution.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text (such as labels and conceptual claims) which is then interpolated into prompts for image generation.
  • Ingestion points: User-defined viewer_question, concrete_claim, and labels processed in SKILL.md.
  • Boundary markers: The workflow relies on clear instructions for the agent to verify text verbatim, though no specific programmatic delimiters are used for the user input.
  • Capability inventory: The skill can perform local file writes via scripts/cutout.py and execute local Python scripts.
  • Sanitization: The agent is explicitly instructed to perform a character-by-character visual inspection of the generated assets against the original brief, providing a manual validation gate for all interpolated content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 01:00 AM
Security Audit — agent-trust-hub — lora-visual