infographic-builder

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes shell commands to manage its workflow. Specifically, it uses grep and cut to retrieve API credentials, curl to interact with the KIE AI API, and python to execute a local image processing script (overlay_logo.py). These operations are consistent with the skill's stated purpose of automated image generation and branding.
  • [EXTERNAL_DOWNLOADS]: The skill downloads generated image files from the KIE AI API infrastructure (api.kie.ai). These downloads are the intended output of the generation process and are performed only after explicit task completion.
  • [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided topics which are then interpolated into prompts for the KIE AI image generation model.
  • Ingestion points: User-provided infographic topics in SKILL.md.
  • Boundary markers: The skill provides explicit style instructions and content constraints to the agent to guide the prompt generation.
  • Capability inventory: File writing (saving images), Network access (API calls and image downloads), and execution of a local Python script.
  • Sanitization: The skill relies on natural language instructions to ensure content remains educational and appropriate.
  • [CREDENTIALS_UNSAFE]: The skill retrieves a KIE_API_KEY from a local .env file. This is documented as a safe and standard practice for secret management in development environments, ensuring that sensitive keys are not hardcoded directly into the instructions or scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 08:40 PM