commerce-detail-page-image
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill performs image manipulation using the trusted Pillow library, which is a standard requirement for these tasks.
- [COMMAND_EXECUTION]: The skill includes a Python script to stitch images vertically. The script uses safe path handling via the pathlib library and operates only on files within the designated project directory.
- [EXTERNAL_DOWNLOADS]: The skill requires the Pillow library, which is a well-known and reputable package available through the official Python Package Index (PyPI).
- [PROMPT_INJECTION]: The skill processes user-supplied JSON copy to construct image generation prompts. While this is an ingestion point for untrusted data, the risk is minimal because the capabilities are restricted to generating image files and local stitching, with no path to arbitrary code execution. Ingestion points: copy_json_path; Boundary markers: Structured prompt templates; Capability inventory: media-higgsfield-image tool call, local file writing; Sanitization: None.
Audit Metadata