cli-gpt-image
Pass
Audited by Gen Agent Trust Hub on Jun 9, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The script
scripts/gpt-imageaccesses the sensitive file~/.codex/auth.jsonto retrieve OpenAI authentication tokens (access, refresh, and ID tokens). This is the core functionality of the skill as described in the documentation. - [EXTERNAL_DOWNLOADS]: The skill performs network requests to official OpenAI domains, specifically
auth.openai.comfor token refreshment andchatgpt.comfor image generation. These are well-known services and essential for the tool's primary purpose. - [COMMAND_EXECUTION]: The package includes a Python script
scripts/gpt-imagedesigned to be executed from the terminal. It includes an installation scriptscripts/install.shthat copies the utility to~/.local/binand suggests PATH modifications, which is standard behavior for CLI tools. - [SAFE]: The Python script is written using only the standard library (
stdlib-only), meaning it has no external pip dependencies that could introduce supply-chain risks. - [SAFE]: Credentials refreshed by the tool are cached locally in
~/.config/gpt-image/token.jsonwith restricted permissions (chmod 600), following security best practices for token management.
Audit Metadata