image-ad-clone

Pass

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a Python script, scripts/validate_image.py, to interact with the Novoads Image API. The script is well-structured, uses only Python standard libraries, and performs routine tasks such as uploading reference images and submitting generation requests.
  • [DATA_EXFILTRATION]: The skill accesses the NOVOADS_API_KEY from a .env file to authenticate with https://api.novoads.ai. As this domain belongs to the skill's author (novoads), this is considered standard and safe functionality for an API-integrated tool.
  • [PROMPT_INJECTION]: The 10-phase workflow includes robust validation steps, such as Phase 6 (generalization into placeholders) and Phase 7 (testing against different brands), which effectively prevent the final templates from inheriting or being influenced by malicious instructions potentially embedded in source ads.
  • [EXTERNAL_DOWNLOADS]: The script downloads generated image variants from the vendor's API to a local iterations/ directory. These downloads are part of the core validation workflow and originate from the vendor's own infrastructure.
  • [SAFE]: The Python script includes hardcoded safety suffixes (NO_CHROME_SUFFIX, SAFE_ZONE_SUFFIX, GLYPH_SAFETY_SUFFIX) that are appended to every prompt before submission, ensuring that the generated content remains within safety and quality constraints.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 7, 2026, 06:27 PM
Security Audit — agent-trust-hub — image-ad-clone