gpt-image

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The launcher script scripts/generate.py utilizes subprocess.run to call the gpt-image CLI or tool managers like uvx. This is the standard mechanism for the skill to perform its intended image generation tasks.
  • [EXTERNAL_DOWNLOADS]: The skill instructions and launcher script provide the capability to fetch the core CLI tool from the author's GitHub repository (wuyoscar/gpt_image_2_skill) using the uvx runner, which is a routine practice for agent-based tool deployment.
  • [INDIRECT_PROMPT_INJECTION]: Reference materials such as references/craft.md and references/gallery-research-paper-figures.md include example prompt injection payloads. These are clearly contextualized as educational illustrations for creating security-focused diagrams and are not meant to be followed as instructions by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 06:12 AM