product-shots-main-image
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows secure development practices by delegating sensitive operations like API key management and image generation to a dedicated internal engine ('product-shots-image-gen').
- [PROMPT_INJECTION]: The skill processes user-provided descriptions to formulate image generation prompts, representing a standard surface for indirect prompt injection common in creative tools. This is handled through structured templates and is considered a low-risk architectural pattern.
- Ingestion points:
user_requestobject inSKILL.md. - Boundary markers: Absent in the pseudocode prompt assembly logic.
- Capability inventory: Invokes the
product-shots-image-genskill for image creation. - Sanitization: No explicit sanitization of user-provided strings is mentioned before interpolation.
- [DATA_EXFILTRATION]: No network exfiltration, hardcoded credentials, or unauthorized access to sensitive file paths (such as SSH or AWS configurations) were found.
- [REMOTE_CODE_EXECUTION]: No remote script downloads (e.g., curl|bash), package installations, or dynamic execution of untrusted code (e.g., eval/exec) were detected.
Audit Metadata