image-assets
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runinscripts/_env.pyandscripts/image_assets_cli.pyto manage a local Python virtual environment and execute internal scripts. These operations are scoped to the skill's own directory. - [EXTERNAL_DOWNLOADS]: The skill downloads
get-pip.pyfrom the officialbootstrap.pypa.iodomain to ensure pip is available for environment setup. It also installs standard packages from PyPI and NPM registries. - [REMOTE_CODE_EXECUTION]: In
scripts/cutout_images.py, the skill usestrust_remote_code=Truewhen loading vision models from Hugging Face. This is a standard requirement for the specific model architectures (RMBG-2.0 and BiRefNet) used for high-quality background removal. - [SAFE]: Static analysis flagged an
eval()call inscripts/cutout_images.py, but manual review confirms this is the PyTorch.eval()method used for setting models to inference mode, not the hazardous Python built-in function.
Audit Metadata