meitu-stickers
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
meitu-clipackage via npm, which is the official command-line tool provided by the vendor for its AI platform. - [COMMAND_EXECUTION]: The skill invokes the
meituCLI to perform image generation, splitting, and conversion tasks. These commands are executed locally using parameters derived from user input. - [INDIRECT_PROMPT_INJECTION]: The skill incorporates user-provided images and style descriptions into prompts sent to the image generation tool.
- Ingestion points: User-uploaded images and the
{user_style_description}variable within the prompt templates inreferences/prompts.md. - Boundary markers: No specific delimiters or "ignore instructions" warnings are applied to the interpolated user input.
- Capability inventory: Shell execution of the
meituCLI and writing generated image files to the local filesystem (./output/and$VISUALworkspace). - Sanitization: The skill does not perform explicit sanitization of the user-provided style descriptions before incorporating them into the final prompt.
Audit Metadata