transform-describe-image-with-transloadit
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx -y @transloadit/nodeto download and execute the official Transloadit Node.js CLI directly from the NPM registry. - [COMMAND_EXECUTION]: The skill invokes the Transloadit CLI via shell commands to process images and retrieve assembly status.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from an external source (Transloadit API results) which represents an attack surface for indirect prompt injection.
- Ingestion points: Data enters the agent's context through the output of the
image describecommand (SKILL.md). - Boundary markers: None identified in the skill instructions.
- Capability inventory: The skill uses
npxfor command execution and local file writes inSKILL.md. - Sanitization: No explicit sanitization of the API-generated labels or descriptions is performed before the agent processes or confirms the output.
Audit Metadata