gpt-imagegen
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes Python scripts to interact with an image generation API and perform local image tiling and stitching. These scripts are implemented using only standard library modules, avoiding third-party dependency risks.
- [CREDENTIALS_UNSAFE]: API keys are managed through standard configuration files (~/.config/) or environment variables. The skill includes explicit instructions for the AI agent to never invent or leak these secrets.
- [DATA_EXFILTRATION]: All network requests for images and API calls are protected by a safety gate that validates hostnames and IP addresses. The implementation includes DNS resolution checks to block access to loopback, private, and reserved IP ranges, effectively preventing SSRF-style attacks.
- [DYNAMIC_EXECUTION]: The check_environment.py script uses importlib.import_module to verify that necessary standard library modules are present on the system. This use is safe as it is constrained to a static whitelist of modules.
Audit Metadata