infographic-builder
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands to manage its workflow. Specifically, it uses
grepandcutto retrieve API credentials,curlto interact with the KIE AI API, andpythonto execute a local image processing script (overlay_logo.py). These operations are consistent with the skill's stated purpose of automated image generation and branding. - [EXTERNAL_DOWNLOADS]: The skill downloads generated image files from the KIE AI API infrastructure (
api.kie.ai). These downloads are the intended output of the generation process and are performed only after explicit task completion. - [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided topics which are then interpolated into prompts for the KIE AI image generation model.
- Ingestion points: User-provided infographic topics in
SKILL.md. - Boundary markers: The skill provides explicit style instructions and content constraints to the agent to guide the prompt generation.
- Capability inventory: File writing (saving images), Network access (API calls and image downloads), and execution of a local Python script.
- Sanitization: The skill relies on natural language instructions to ensure content remains educational and appropriate.
- [CREDENTIALS_UNSAFE]: The skill retrieves a
KIE_API_KEYfrom a local.envfile. This is documented as a safe and standard practice for secret management in development environments, ensuring that sensitive keys are not hardcoded directly into the instructions or scripts.
Audit Metadata