text-to-image
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
meituCLI to process image generation requests, passing user-supplied text descriptions and image URLs as command arguments. - [SAFE]: The skill accesses configuration and credential files at
~/.meitu/credentials.jsonand~/.meitu/tool-registry.json. These are vendor-specific paths required for the Meitu CLI tool to authenticate with the vendor's API and are consistent with the skill's primary purpose. - [SAFE]: A potential surface for indirect prompt injection exists as the skill processes untrusted user input.
- Ingestion points: User-provided
promptandimage_listparameters. - Boundary markers: None present; input is interpolated directly into the CLI command template.
- Capability inventory: Execution of the
meituCLI tool (defined inSKILL.md). - Sanitization: No explicit sanitization or validation of the input strings is performed within the skill instructions.
Audit Metadata