skills/x0c/image-skills/image-assets/Gen Agent Trust Hub

image-assets

Warn

Audited by Gen Agent Trust Hub on Oct 31, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill enables remote code execution by setting trust_remote_code=True when loading image segmentation models (briaai/RMBG-2.0 and ZhengPeng7/BiRefNet) via the Hugging Face Transformers library. This allows custom logic defined in the remote model repositories to execute during model initialization.
  • [EXTERNAL_DOWNLOADS]: The skill performs automated downloads of infrastructure tools and libraries at runtime. It fetches get-pip.py from bootstrap.pypa.io to bootstrap its environment if needed, and installs multiple Python packages from PyPI and the sharp library from NPM into isolated local directories (.venv and .node-deps).
  • [DYNAMIC_EXECUTION]: The skill dynamically executes downloaded content, such as the get-pip.py script, and manages its own runtime environment by installing dependencies programmatically during its first run.
  • [COMMAND_EXECUTION]: The skill extensively uses the subprocess module in Python and child_process in Node.js to coordinate the execution of its various scripts and manage external tools like pip, npm, node, pngquant, and oxipng.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 31, 2026, 08:55 AM