imagine-podcast

Pass

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes local JavaScript modules (scripts/lib/upscale.js, scripts/lib/compose-text.js) to perform image processing and typography tasks. It also optionally attempts to invoke the realesrgan-ncnn-vulkan CLI for AI upscaling, with a documented fallback mechanism to Lanczos3 filtering if the binary is not found in the environment.
  • [EXTERNAL_DOWNLOADS]: The skill requires the standard sharp Node.js library for image manipulation, as indicated in its failure mode documentation.
  • [PROMPT_INJECTION]: The skill ingests user-provided text for podcast names and episode titles, creating a potential surface for indirect prompt injection.
  • Ingestion points: User-supplied show names, episode titles, and slugs passed through command arguments.
  • Boundary markers: The skill implements a strong safety architecture by explicitly prohibiting the injection of user-supplied text into the AI image generation prompt to prevent prompt injection or hallucinated artifacts.
  • Capability inventory: The skill has capabilities for local file writing (restricted to ./images/podcast/), image generation, and subprocess execution for image processing tools.
  • Sanitization: User inputs are used exclusively for local typographic composition; filenames are sanitized using slugification to prevent path traversal.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 31, 2026, 01:01 PM
Security Audit — agent-trust-hub — imagine-podcast