kernel-image

Pass

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to execute local TypeScript scripts (scripts/generate-image.ts and scripts/generate-turnaround.ts) using the Bun JavaScript runtime. These scripts are responsible for the core generation logic, including API requests and file management.
  • [EXTERNAL_DOWNLOADS]: The skill initiates network requests to https://openrouter.ai/api/v1/chat/completions using the fetch API. This is a well-known service for accessing various AI models and is used here for its primary intended purpose.
  • [DATA_EXFILTRATION]: While the skill accesses a user-provided OPENROUTER_API_KEY from the environment, it uses this exclusively for authorized requests to the OpenRouter API. Metadata and generated assets are stored locally in the user's ~/Desktop and ~/.hominem/ai_usage/ directories.
  • [SAFE]: The skill includes defensive code in its generation scripts, such as a slugify function that sanitizes user-provided strings by removing non-alphanumeric characters. This mitigates risks associated with path traversal or shell injection when generating folder and file names on the local file system.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 7, 2026, 02:08 PM
Security Audit — agent-trust-hub — kernel-image