commerce-product-photo-brief
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill facilitates the analysis of product imagery to extract marketing data (ProductDNA) and identify missing visual assets. The logic is purely instructional and generates textual output based on visual input. No security issues were identified in the metadata, trigger keywords, or workflow logic.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes external, untrusted data.
- Ingestion points: The skill analyzes 1-14 user-provided product photos via vision capabilities (Step 1 in
SKILL.md). - Boundary markers: There are no explicit instructions to the AI to ignore text or instructions that might be embedded within the provided images.
- Capability inventory: The skill is limited to textual output and JSON generation; it does not have access to tools for network operations, file system modification, or command execution.
- Sanitization: No sanitization or validation logic is defined for the content extracted from the images.
- Assessment: Due to the lack of dangerous capabilities, the presence of this ingestion point does not pose a significant risk to the user or system environment.
Audit Metadata