reve-image
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied text prompts and reference images which are passed to the API. This creates a potential surface for indirect prompt injection where malicious instructions could be embedded in data.
- Ingestion points: User prompts and reference image URLs or base64 data strings processed in
SKILL.md. - Boundary markers: The skill does not define specific delimiters or instructions to the agent to isolate user-supplied data from the operational context.
- Capability inventory: The skill performs network operations (HTTP POST) via
curl, Pythonrequests, and Node.jsfetchto communicate with the external API. - Sanitization: No explicit sanitization, validation, or filtering of the prompt content is documented before transmission.
- [EXTERNAL_DOWNLOADS]: The skill references a command for installing additional capabilities from the vendor's own repository.
- Evidence: Reference to
npx skills add Pixazo-AI/skills --skill '*'in the related skills section.
Audit Metadata