image-prompt-guide
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to run a local Node.js script (
node skills/image-prompt-kit/scripts/check_prompt.mjs) to validate high-value prompt outputs. This execution is part of the skill's quality assurance workflow and uses relative paths within the agent's environment. - [INDIRECT_PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection as it processes user-provided inputs to generate complex image prompts. It implements mitigation strategies through strict structural requirements and a mandatory validation step.
- Ingestion points: User-provided visual descriptions and image generation requests are processed in
references/full.md. - Boundary markers: The skill enforces specific output formats (Format A and Format B) with defined sections (Scene, Camera, Lighting, etc.) to structure the generated content.
- Capability inventory: The agent is authorized to execute a local validation script and load large reference files.
- Sanitization: Output is validated against a script (
check_prompt.mjs) which checks for restricted terms (SD-era keywords) and structural integrity before the result is finalized.
Audit Metadata