text-to-visual

Pass

Audited by Gen Agent Trust Hub on Aug 15, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions in SKILL.md to install the Picsart gen-ai CLI using a piped shell command (curl -fsSL https://picsart.com/gen-ai-cli/install.sh | bash). This operation downloads and executes code from the vendor's official domain.
  • [COMMAND_EXECUTION]: The skill extensively uses shell commands to invoke the gen-ai CLI for image generation, pricing checks, and batch processing as seen in SKILL.md and the mode references.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input such as blog drafts, URL content, and user-provided text to construct prompts for visual generation.
  • Ingestion points: Input paragraphs, article drafts, and URL metadata defined in SKILL.md and references/modes/og.md.
  • Boundary markers: The skill suggests escaping quotes and newlines in references/modes/og.md to maintain command integrity.
  • Capability inventory: The skill utilizes shell command execution via the gen-ai CLI.
  • Sanitization: The instructions recommend input truncation (70 characters) and the use of escaping utilities like jq or printf to sanitize data before interpolation.
  • [SAFE]: The remote code execution and external resources originate from the skill author's official infrastructure (picsart.com), representing expected vendor functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 15, 2026, 07:18 AM
Security Audit — agent-trust-hub — text-to-visual