lov-spectacular-ps

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes local Python scripts to handle specialized tasks. scripts/compare_images.py uses the Pillow library to create side-by-side comparison boards of original and edited images, implementing safety checks such as a 50-megapixel limit to prevent resource exhaustion attacks. scripts/profile_store.py manages user preferences in a local JSON file using atomic write operations and includes a blacklist to prevent the storage of sensitive fields such as tokens, passwords, or API keys.
  • [EXTERNAL_DOWNLOADS]: Documentation in the skill guides users to install standard, well-known Python dependencies including PyYAML (used for metadata validation) and Pillow (used for image processing). These are standard libraries used for the skill's documented functionality.
  • [INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves processing user-uploaded images and style references to generate prompts for generative image editing tools. This creates an attack surface for indirect prompt injection via image content or metadata. To mitigate this risk, the skill incorporates robust defensive instructions in SKILL.md and references/prompt-template.md, explicitly mandating that the user's identity from the original source photo must be strictly preserved and that reference images are used only for composition and lighting guidelines.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 04:33 PM