flux-best-practices
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists entirely of Markdown documentation and instructional guides. No executable scripts (.py, .js, .sh), binaries, or configuration files that could trigger automated actions were found within the skill package.
- [NO_CODE]: There are no scripts or code files present in the skill. All instructions are provided as natural language or examples for the user/agent to follow when interacting with external image generation APIs.
- [INDIRECT_PROMPT_INJECTION]: The skill defines templates for structured prompting (e.g., in
rules/json-structured-prompting.mdusing placeholders like{{PRODUCT_NAME}}). While this creates a potential surface for indirect prompt injection if an agent interpolates untrusted user data into these templates, the skill itself does not provide or request any dangerous capabilities (such as shell execution or file system writes) that could be leveraged by such an injection. The lack of associated tools or scripts renders the risk negligible.
Audit Metadata