Skills
skills/openclaudia/openclaudia-skills/generate-image/Gen Agent Trust Hub

generate-image

Pass

Audited by Gen Agent Trust Hub on May 18, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection.
  • Ingestion points: Untrusted user input is accepted via the --prompt argument in SKILL.md.
  • Boundary markers: Absent; there are no delimiters or instructions for the agent to sanitize the user input before processing.
  • Capability inventory: The skill uses the Bash tool to execute generate-image.py.
  • Sanitization: Absent; the skill does not specify any validation or escaping mechanisms for the prompt string.
  • [COMMAND_EXECUTION]: The skill relies on shell command execution to perform its primary function.
  • It executes python ~/.agents/tools/generate-image.py with arguments derived from user input, which presents a risk of command injection if the agent does not properly escape the shell arguments.
  • [EXTERNAL_DOWNLOADS]: The skill documentation includes instructions to install a standard Python library.
  • Recommends the installation of the well-known requests package from the official Python Package Index (PyPI).
Audit Metadata
Risk Level
SAFE
Analyzed
May 18, 2026, 03:46 PM
Security Audit — agent-trust-hub — generate-image