image-element-remove
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
meitucommand-line interface. This is a vendor-provided tool used to interface with the Meitu OpenAPI for image processing. The tool is invoked to perform element removal based on user-provided parameters.\n- [EXTERNAL_DOWNLOADS]: The instructions guide the user to install or update themeitu-clipackage via the NPM registry. This is the official tool for the service provided by the vendor. The CLI interacts with Meitu's official OpenAPI endpoints for image processing.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied image descriptions, creating an ingestion point for untrusted data inSKILL.md. It uses a structured four-segment English prompt template (incorporating SCOPE, PRESERVE, REFLOW, and NEGATIVE sections) as a boundary to guide the image editing model. The available capabilities are restricted to executing themeituCLI and writing processed images to specified local directories (./output/and workspace paths). No explicit sanitization of the user description is mentioned beyond the template structure.\n- [DATA_EXPOSURE]: The skill accesses API credentials stored in~/.meitu/credentials.jsonor provided via environment variables such asMEITU_OPENAPI_ACCESS_KEY. This access is explicitly declared in the skill's metadata and requirements for the purpose of authenticating with the vendor's image processing service.
Audit Metadata