image-assets

Pass

Audited by Gen Agent Trust Hub on Jul 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/_env.py and scripts/image_assets_cli.py to manage a local Python virtual environment and execute internal scripts. These operations are scoped to the skill's own directory.
  • [EXTERNAL_DOWNLOADS]: The skill downloads get-pip.py from the official bootstrap.pypa.io domain to ensure pip is available for environment setup. It also installs standard packages from PyPI and NPM registries.
  • [REMOTE_CODE_EXECUTION]: In scripts/cutout_images.py, the skill uses trust_remote_code=True when loading vision models from Hugging Face. This is a standard requirement for the specific model architectures (RMBG-2.0 and BiRefNet) used for high-quality background removal.
  • [SAFE]: Static analysis flagged an eval() call in scripts/cutout_images.py, but manual review confirms this is the PyTorch .eval() method used for setting models to inference mode, not the hazardous Python built-in function.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 28, 2026, 03:11 AM