image-ad-clone
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a Python script,
scripts/validate_image.py, to interact with the Novoads Image API. The script is well-structured, uses only Python standard libraries, and performs routine tasks such as uploading reference images and submitting generation requests. - [DATA_EXFILTRATION]: The skill accesses the
NOVOADS_API_KEYfrom a.envfile to authenticate withhttps://api.novoads.ai. As this domain belongs to the skill's author (novoads), this is considered standard and safe functionality for an API-integrated tool. - [PROMPT_INJECTION]: The 10-phase workflow includes robust validation steps, such as Phase 6 (generalization into placeholders) and Phase 7 (testing against different brands), which effectively prevent the final templates from inheriting or being influenced by malicious instructions potentially embedded in source ads.
- [EXTERNAL_DOWNLOADS]: The script downloads generated image variants from the vendor's API to a local
iterations/directory. These downloads are part of the core validation workflow and originate from the vendor's own infrastructure. - [SAFE]: The Python script includes hardcoded safety suffixes (
NO_CHROME_SUFFIX,SAFE_ZONE_SUFFIX,GLYPH_SAFETY_SUFFIX) that are appended to every prompt before submission, ensuring that the generated content remains within safety and quality constraints.
Audit Metadata