lora-visual
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts,
scripts/cutout.pyandscripts/validate_mode_b.py, to perform background removal (chroma-keying) and image quality validation. These operations are confined to the agent's local environment and are used to manage project assets. - [EXTERNAL_DOWNLOADS]: The skill requires the
Pillow(PIL) Python library for image manipulation. This is a well-known, standard library in the Python ecosystem and is appropriate for the skill's stated purpose. - [DYNAMIC_EXECUTION]: The test suite located in
tests/test_validate_mode_b.pyutilizesimportlib.utilto dynamically load the validation script for unit testing purposes. This is a standard developer practice for testing local modules and does not present a security risk within the context of the skill's execution. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text (such as labels and conceptual claims) which is then interpolated into prompts for image generation.
- Ingestion points: User-defined
viewer_question,concrete_claim, andlabelsprocessed inSKILL.md. - Boundary markers: The workflow relies on clear instructions for the agent to verify text verbatim, though no specific programmatic delimiters are used for the user input.
- Capability inventory: The skill can perform local file writes via
scripts/cutout.pyand execute local Python scripts. - Sanitization: The agent is explicitly instructed to perform a character-by-character visual inspection of the generated assets against the original brief, providing a manual validation gate for all interpolated content.
Audit Metadata