image-gen

Fail

Audited by Gen Agent Trust Hub on Jul 23, 2026

Risk Level: HIGHCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The file scripts/image-gen.py contains a hardcoded API key in the headers dictionary. Specifically, the Authorization header includes a long-lived bearer token (sk-cp-...) used to authenticate with the MiniMax API. This exposes the secret to anyone with access to the source code.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data with significant capabilities. 1. Ingestion points: The prompt variable in scripts/image-gen.py is populated by agent-supplied input. 2. Boundary markers: No delimiters or ignore instructions are used to wrap the input. 3. Capability inventory: The skill can perform network requests to api.minimaxi.com and write arbitrary files to the local system based on the output_filename argument. 4. Sanitization: No input validation or filtering is performed on the prompt or filename before use.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jul 23, 2026, 05:57 PM
Security Audit — agent-trust-hub — image-gen