imagine-create
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill constructs and executes shell commands using the
vofy-clitool. User inputs like prompts, models, and file paths are interpolated into these commands, creating a potential surface for shell command injection.\n - Ingestion points: User-provided values for
<prompt>,<model>, and<path>placeholders inSKILL.mdandexamples.md.\n - Boundary markers: Commands use double quotes for prompts (e.g.,
--prompt "<prompt>"), which is a weak boundary against advanced shell injection.\n - Capability inventory: The skill executes shell commands that perform network requests and write to the local file system (
--download-to ./output).\n - Sanitization: The instructions do not specify any validation or sanitization of the user input before it is passed to the shell.\n- [EXTERNAL_DOWNLOADS]: The skill requires the installation of an external CLI tool to function.\n
- Evidence: Instructions in
SKILL.mdask the user to installvofy-cli@0.1.7if it is not present.
Audit Metadata