transform-remove-background-with-transloadit
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using
npxto interact with the Transloadit API for image processing jobs and debugging (SKILL.md).- [EXTERNAL_DOWNLOADS]: The skill utilizesnpx -y @transloadit/nodeto download the official CLI tool from the public NPM registry. This is a legitimate dependency provided by the vendor (transloadit) for the skill's primary function.- [CREDENTIALS_UNSAFE]: The skill instructs the agent to resolve credentials from~/.transloadit/credentialsand.envfiles. These are the standard storage locations for the Transloadit service's configuration and are managed according to the vendor's best practices.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied file paths as input for transformation. - Ingestion points: Absolute paths for local input and output images are accepted as input and used in shell commands (
SKILL.md). - Boundary markers: The skill does not provide specific boundary markers or instructions to treat these paths as untrusted.
- Capability inventory: The skill has the capability to write files (
steps.json) and execute shell commands (SKILL.md). - Sanitization: No instructions are provided for sanitizing or validating the input file paths before they are used in command-line execution.
Audit Metadata