image-ecommerce
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The skill reads local product images from the workspace (e.g., from the
uploads/directory), encodes them as base64 data URIs, and transmits them to external image generation endpoints atfal.runvia an internal proxy (sc-proxy.internal). This is the intended behavior for an image transformation tool. - [COMMAND_EXECUTION]: The documentation in
SKILL.mdprovides Python code snippets and instructions for the agent to execute the skill's logic using thebashtool with a heredoc pattern (`python3 - <<'EOF'`). This is a standard execution pattern for script-based skills on this platform.
- [EXTERNAL_DOWNLOADS]: Upon successful image generation, the script automatically downloads the result files from the
fal.mediaCDN to the localoutput/images/directory. This is necessary for the agent to serve images to the user without hitting Content Security Policy (CSP) restrictions in the browser. - [SAFE]: The skill includes a
_cost_track.pyutility that records metadata about paid API calls to a local ledger. This process uses standard libraries, includes proper file locking withfcntl, and does not expose sensitive information.
Audit Metadata