imagine-podcast
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local JavaScript modules (
scripts/lib/upscale.js,scripts/lib/compose-text.js) to perform image processing and typography tasks. It also optionally attempts to invoke therealesrgan-ncnn-vulkanCLI for AI upscaling, with a documented fallback mechanism to Lanczos3 filtering if the binary is not found in the environment. - [EXTERNAL_DOWNLOADS]: The skill requires the standard
sharpNode.js library for image manipulation, as indicated in its failure mode documentation. - [PROMPT_INJECTION]: The skill ingests user-provided text for podcast names and episode titles, creating a potential surface for indirect prompt injection.
- Ingestion points: User-supplied show names, episode titles, and slugs passed through command arguments.
- Boundary markers: The skill implements a strong safety architecture by explicitly prohibiting the injection of user-supplied text into the AI image generation prompt to prevent prompt injection or hallucinated artifacts.
- Capability inventory: The skill has capabilities for local file writing (restricted to
./images/podcast/), image generation, and subprocess execution for image processing tools. - Sanitization: User inputs are used exclusively for local typographic composition; filenames are sanitized using slugification to prevent path traversal.
Audit Metadata