image-2-ad-image
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads model configurations, pricing data, and generated image results from the vendor domain ai-hive.iclip.cn. This is the intended behavior for the service.\n- [SAFE]: The script imagegen.py manages an API key in a local configuration file (~/.ai-hive/config.json) and correctly applies restrictive file permissions (0600) to protect the secret from other users on the system.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides an interface that processes user-supplied prompts and reference images which constitutes an attack surface.\n
- Ingestion points: User-defined prompts and image paths provided via command-line arguments in scripts/imagegen.py.\n
- Boundary markers: None; inputs are passed directly to the API endpoint without delimiters.\n
- Capability inventory: Includes network communication with the API and file system writes for downloading results.\n
- Sanitization: No local sanitization is performed on prompts before they are transmitted to the backend service.
Audit Metadata