image-2-background-replace
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on a Python script (
imagegen.py) to interact with the AI Hive OpenAPI, handling tasks such as media upload, status polling, and result retrieval. - [EXTERNAL_DOWNLOADS]: The skill downloads generated image and video assets from the service provider's domain (
ai-hive.iclip.cn) to the user's local Downloads folder. - [DATA_EXFILTRATION]: As part of its core functionality, the skill transmits user-selected media files and text prompts to the AI Hive API for processing. This behavior is consistent with the skill's stated purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-defined prompts and images to facilitate content generation. While it lacks specific boundary markers to isolate these inputs within the API request body, the risk is inherent to the primary function of an image generation wrapper.
- [SAFE_PRACTICE]: The CLI implements best practices for secret management by storing API keys in a local configuration file (
~/.ai-hive/config.json) and explicitly setting file permissions to0600(read/write by owner only) to prevent unauthorized access by other local users.
Audit Metadata