youmind-image-generator
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
youmindCLI to interface with server-side AI models (GPT Image, Gemini, Seedream) and manage user data on the YouMind platform. It also executes a local Node.js script for parsing results. - [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the
@youmind-ai/clipackage from the npm registry as a prerequisite. This is an official tool provided by the vendor to facilitate API interactions. - [INDIRECT_PROMPT_INJECTION]: The skill processes message data from an external API response to extract generated image URLs. This ingestion surface is mitigated by the use of a dedicated extraction script (
scripts/extract-images.js) that parses the JSON response and applies specific validation logic rather than directly interpolating the raw API content into the agent's prompt.
Audit Metadata