transform-generate-image-with-transloadit
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto download and execute the@transloadit/nodepackage. This is the official CLI package provided by the skill author (transloadit) for interfacing with their image generation API. - [COMMAND_EXECUTION]: Runs shell commands to generate images and check assembly status. The use of
npx -yallows the command to execute without user prompts for package installation. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text prompts and local filenames which are interpolated into shell commands, creating an injection surface.
- Ingestion points: User input for the
--promptargument and file paths for the--inputargument in the commands defined inSKILL.md. - Boundary markers: None; user-supplied strings are placed directly into command-line arguments.
- Capability inventory: Shell command execution and file system access for reading inputs and writing output files.
- Sanitization: The skill instructions do not specify any validation or sanitization for the provided prompts or paths.
Audit Metadata