image
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the 'cyeam' CLI tool to execute image processing tasks. It maps user-supplied parameters, such as file paths and image dimensions, to shell command arguments.
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection risk by interpolating untrusted data (filenames) into shell command strings without specifying sanitization or boundary markers. * Ingestion points: User-provided filenames and conversion options in the SKILL.md file. * Boundary markers: There are no delimiters or instructions provided to isolate user-supplied data from the command logic. * Capability inventory: Subprocess execution via the 'cyeam' utility. * Sanitization: The instructions do not define any validation or escaping protocols for the variable before it is passed to the shell.
Audit Metadata