ofox-image-core
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a functional wrapper for the Ofox text-to-image API, facilitating synchronous generation requests.
- [CREDENTIALS_SAFE]: The skill implements robust secret management by requiring the
OFOX_API_KEYto be supplied via the shell environment. It explicitly forbids hardcoding, logging, or echoing the key value in any output or file. - [COMMAND_EXECUTION]: Legitimate use of
curlandjqis observed for API interaction and JSON processing. The scriptreferences/ofox-image.shusesjq --argto safely handle user-supplied prompts, mitigating injection risks during request construction. - [EXTERNAL_DOWNLOADS]: The skill fetches model information from the vendor's official public endpoint (
api.ofox.ai/v1/models) to enable client-side validation of model IDs and pricing. This activity is transparently documented and serves a functional purpose. - [DATA_EXFILTRATION]: Network activity is restricted to the documented vendor API. There is no evidence of the skill accessing sensitive local files or transmitting data to unauthorized third-party domains.
Audit Metadata