ecommerce-image-workflow
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a POSIX bash loop to call a specialized media dispatcher (
$OD_BIN media generateand$OD_BIN media wait). This is the standard mechanism for the platform's image generation and does not involve arbitrary command execution or shell injection risks from untrusted sources. - [REMOTE_CODE_EXECUTION]: The skill uses
python3for parsing JSON output from the media dispatcher. The script logic is static and only extracts specific fields (taskId,nextSince) from the tool's own output, which is a safe and common pattern. - [PROMPT_INJECTION]: Instructions include a clear 'fidelity lock' to prevent the model from redesigning the product or inventing claims. There are no attempts to bypass safety filters or override system instructions.
- [DATA_EXPOSURE]: The skill generates project-relative files (
image-manifest.json,ecommerce-gallery.html) based on local project data. It does not access sensitive system files, credentials, or make external network requests to non-whitelisted domains.
Audit Metadata