kaipai-image-repair
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
meitu-kaipai-clipackage (version 0.1.8) from the npm registry. It also downloads user-specified remote images for processing using a dedicated download command. - [COMMAND_EXECUTION]: The skill executes shell commands via the
kaipaiCLI to perform image repairs, manage authentication, and track task progress. It includes instructions for safe argument passing and shell escaping. - [DATA_EXFILTRATION]: User-provided images are uploaded to Meitu's CDN for processing. This data transfer is a core function of the skill and is handled through the vendor's official command-line interface.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content from image URLs and file metadata. It mitigates risks by downloading assets to controlled local directories and performing validation checks (e.g., via
ffprobe) before submission.
Audit Metadata