kernel-image
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to execute local TypeScript scripts (scripts/generate-image.tsandscripts/generate-turnaround.ts) using the Bun JavaScript runtime. These scripts are responsible for the core generation logic, including API requests and file management. - [EXTERNAL_DOWNLOADS]: The skill initiates network requests to
https://openrouter.ai/api/v1/chat/completionsusing thefetchAPI. This is a well-known service for accessing various AI models and is used here for its primary intended purpose. - [DATA_EXFILTRATION]: While the skill accesses a user-provided
OPENROUTER_API_KEYfrom the environment, it uses this exclusively for authorized requests to the OpenRouter API. Metadata and generated assets are stored locally in the user's~/Desktopand~/.hominem/ai_usage/directories. - [SAFE]: The skill includes defensive code in its generation scripts, such as a
slugifyfunction that sanitizes user-provided strings by removing non-alphanumeric characters. This mitigates risks associated with path traversal or shell injection when generating folder and file names on the local file system.
Audit Metadata