text-to-visual
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions in
SKILL.mdto install the Picsartgen-aiCLI using a piped shell command (curl -fsSL https://picsart.com/gen-ai-cli/install.sh | bash). This operation downloads and executes code from the vendor's official domain. - [COMMAND_EXECUTION]: The skill extensively uses shell commands to invoke the
gen-aiCLI for image generation, pricing checks, and batch processing as seen inSKILL.mdand the mode references. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input such as blog drafts, URL content, and user-provided text to construct prompts for visual generation.
- Ingestion points: Input paragraphs, article drafts, and URL metadata defined in
SKILL.mdandreferences/modes/og.md. - Boundary markers: The skill suggests escaping quotes and newlines in
references/modes/og.mdto maintain command integrity. - Capability inventory: The skill utilizes shell command execution via the
gen-aiCLI. - Sanitization: The instructions recommend input truncation (70 characters) and the use of escaping utilities like
jqorprintfto sanitize data before interpolation. - [SAFE]: The remote code execution and external resources originate from the skill author's official infrastructure (
picsart.com), representing expected vendor functionality.
Audit Metadata