gpt-image
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The launcher script
scripts/generate.pyutilizessubprocess.runto call thegpt-imageCLI or tool managers likeuvx. This is the standard mechanism for the skill to perform its intended image generation tasks. - [EXTERNAL_DOWNLOADS]: The skill instructions and launcher script provide the capability to fetch the core CLI tool from the author's GitHub repository (
wuyoscar/gpt_image_2_skill) using theuvxrunner, which is a routine practice for agent-based tool deployment. - [INDIRECT_PROMPT_INJECTION]: Reference materials such as
references/craft.mdandreferences/gallery-research-paper-figures.mdinclude example prompt injection payloads. These are clearly contextualized as educational illustrations for creating security-focused diagrams and are not meant to be followed as instructions by the agent.
Audit Metadata