image-gen
Fail
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The file
scripts/image-gen.pycontains a hardcoded API key in theheadersdictionary. Specifically, theAuthorizationheader includes a long-lived bearer token (sk-cp-...) used to authenticate with the MiniMax API. This exposes the secret to anyone with access to the source code. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data with significant capabilities. 1. Ingestion points: The
promptvariable inscripts/image-gen.pyis populated by agent-supplied input. 2. Boundary markers: No delimiters or ignore instructions are used to wrap the input. 3. Capability inventory: The skill can perform network requests toapi.minimaxi.comand write arbitrary files to the local system based on theoutput_filenameargument. 4. Sanitization: No input validation or filtering is performed on the prompt or filename before use.
Recommendations
- AI detected serious security threats
Audit Metadata