gen-ai-images
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides integration instructions for official Picsart tools. All external references and package names (e.g.,
@picsart/gen-ai-mcp) are consistent with the verified author 'picsart'. - [DATA_EXFILTRATION]: While the skill includes network operations (e.g., using
curlto download generated images), these are standard functional requirements for an image generation tool and target well-known URLs or user-defined local paths. No sensitive data exfiltration patterns were observed. - [COMMAND_EXECUTION]: The skill documents CLI commands (e.g.,
gen-ai generate,jq,curl). These are provided as legitimate usage examples for the intended purpose of the skill. The '!' dynamic context injection pattern is not used. - [CREDENTIALS_UNSAFE]: The skill does not contain hardcoded secrets. It correctly advises using the
gen-ai whoamicommand to manage session authentication rather than embedding keys. - [INDIRECT_PROMPT_INJECTION]: The skill handles user-provided prompts for image generation. While this is an ingestion surface, the risk is limited to the generation of inappropriate images (content safety), which is managed by the underlying model providers' guardrails rather than being a skill-level security flaw.
Audit Metadata