space-image-skill-builder
Pass
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTIONNO_CODE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes
scripts/generate_image.py, which is designed to be executed via command line to call the Gemini API and save generated images to the local filesystem. This behavior is consistent with the skill's primary function. - [EXTERNAL_DOWNLOADS]: Outbound network connections are made by
scripts/generate_image.pytogenerativelanguage.googleapis.com. This is the official endpoint for the well-known Google Gemini service. - [PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface because it generates instructions for new agents based on user input.
- Ingestion points: User responses provided during the multi-phase interview process described in
SKILL.md. - Boundary markers: Not present in the generation templates found in
references/skill-template.md. - Capability inventory: The toolset available to generated skills includes network access and file system writes via the provided Python script.
- Sanitization: There is no evidence of input validation or escaping before user input is interpolated into the generated
SKILL.mdfiles. - [NO_CODE]: The
SKILL.mdfile refers to a verification script namedquick_validate.pyin Phase 5.6, but this file was not included in the skill package.
Audit Metadata