img-grid
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied file paths for images and output locations, which are interpolated into a shell command. This creates a potential surface for command injection if an attacker provides a crafted path designed to break out of the command string.\n
- Ingestion points: The
<ImagePath>and<OutputPath>arguments defined inSKILL.md.\n - Boundary markers: The command template uses double quotes for the paths, but does not include explicit instructions for the agent to sanitize the input against shell injection.\n
- Capability inventory: The skill utilizes the
Bashtool to execute its image processing script.\n - Sanitization: No sanitization or validation of the input paths is specified in the skill's instructions or metadata.\n- [COMMAND_EXECUTION]: The skill instructions define a command to be executed via the
Bashtool to run theoverlay-grid.pyscript.
Audit Metadata