image-understanding
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions and code snippets contain no signs of obfuscation, malicious logic, or deceptive metadata.
- [COMMAND_EXECUTION]: The skill uses a local script (
scripts/analyze_image.py) to interface with the Zhipu AI API. This follows standard and expected patterns for extending agent capabilities via helper scripts. - [EXTERNAL_DOWNLOADS]: Links within the skill point to official Zhipu AI (BigModel) domains for registration and API management. These are legitimate and trusted services related to the skill's primary purpose.
- [PROMPT_INJECTION]: The skill processes external image data and user queries, which is a standard surface for potential indirect prompt injection. However, the documentation demonstrates safe practices such as quoting arguments to help delimit user input.
- Ingestion points: Image file paths and user-provided questions described in the usage section of
SKILL.md. - Boundary markers: Usage examples include the use of double quotes for the question parameter to help differentiate it from other command arguments.
- Capability inventory: The skill utilizes the ability to run local Python scripts which in turn make network requests to the official Zhipu AI API.
- Sanitization: Standard argument quoting is suggested in the provided usage documentation to prevent simple shell injection issues.
Audit Metadata