apiyi-gpt-image-2-gen
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to construct and run local shell commands (
node scripts/generate_image.jsorpython scripts/generate_image.py) with user-supplied prompts passed through the-por--promptflag. - [INDIRECT_PROMPT_INJECTION]: Untrusted text provided by the user is directly integrated into command line arguments without structural sanitization, representing a classic prompt interpolation surface. However, the risk is mitigated as the skill enforces strict validation on size parameters, image count limits, and data schemas before dispatching inputs to the backend API.
Audit Metadata