image-gen
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The script performs network requests to OpenAI's API (api.openai.com) to generate and edit images. This involves sending user-provided prompt text and reference images to the external service.
- [COMMAND_EXECUTION]: The skill's instructions involve executing a Python script that performs file system writes and network operations.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted user input.
- Ingestion points: The
--promptCLI argument inscripts/image_gen.pyaccepts arbitrary user-controlled strings. - Boundary markers: The prompt is passed directly to the API without delimiters or instructions to ignore embedded commands.
- Capability inventory: The script has the capability to write files to disk and make network requests.
- Sanitization: There is no sanitization or validation performed on the prompt input before it is sent to the remote API.
Audit Metadata