image-ecommerce

Pass

Audited by Gen Agent Trust Hub on Jul 14, 2026

Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DATA_EXFILTRATION]: The skill reads local product images from the workspace (e.g., from the uploads/ directory), encodes them as base64 data URIs, and transmits them to external image generation endpoints at fal.run via an internal proxy (sc-proxy.internal). This is the intended behavior for an image transformation tool.
  • [COMMAND_EXECUTION]: The documentation in SKILL.md provides Python code snippets and instructions for the agent to execute the skill's logic using the bash tool with a heredoc pattern (`python3
  • <<'EOF'`). This is a standard execution pattern for script-based skills on this platform.
  • [EXTERNAL_DOWNLOADS]: Upon successful image generation, the script automatically downloads the result files from the fal.media CDN to the local output/images/ directory. This is necessary for the agent to serve images to the user without hitting Content Security Policy (CSP) restrictions in the browser.
  • [SAFE]: The skill includes a _cost_track.py utility that records metadata about paid API calls to a local ledger. This process uses standard libraries, includes proper file locking with fcntl, and does not expose sensitive information.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 14, 2026, 05:02 PM
Security Audit — agent-trust-hub — image-ecommerce