lov-spectacular-ps
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local Python scripts to handle specialized tasks.
scripts/compare_images.pyuses the Pillow library to create side-by-side comparison boards of original and edited images, implementing safety checks such as a 50-megapixel limit to prevent resource exhaustion attacks.scripts/profile_store.pymanages user preferences in a local JSON file using atomic write operations and includes a blacklist to prevent the storage of sensitive fields such as tokens, passwords, or API keys. - [EXTERNAL_DOWNLOADS]: Documentation in the skill guides users to install standard, well-known Python dependencies including
PyYAML(used for metadata validation) andPillow(used for image processing). These are standard libraries used for the skill's documented functionality. - [INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves processing user-uploaded images and style references to generate prompts for generative image editing tools. This creates an attack surface for indirect prompt injection via image content or metadata. To mitigate this risk, the skill incorporates robust defensive instructions in
SKILL.mdandreferences/prompt-template.md, explicitly mandating that the user's identity from the original source photo must be strictly preserved and that reference images are used only for composition and lighting guidelines.
Audit Metadata