vision
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes image files and user-provided prompts which are sent to vision LLMs, creating a surface for indirect prompt injection if an image contains malicious text designed to influence the model. \n
- Ingestion points: Image file paths and text prompts are ingested as command-line arguments in scripts/vision.py.\n
- Boundary markers: The skill does not implement delimiters or specific system instructions to isolate data from the vision model's processing context.\n
- Capability inventory: The vision script has permissions to read local files and perform network requests to AI provider API endpoints.\n
- Sanitization: No sanitization is performed on the image content or the text prompt before they are passed to the API client.\n- [PERSISTENCE]: The setup scripts (setup.sh and setup.ps1) are designed to modify the agent's persistent configuration file to maintain behavior across sessions.\n
- Mechanism: The scripts inject a UI-check flow from a markdown fragment into the ~/.claude/CLAUDE.md file.\n
- Implementation: The modification is managed using specific start and end markers to ensure idempotency and allow for clean installation or removal.
Audit Metadata