gpt-image
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled background removal script locally using a secure method. Evidence: The
remove_backgroundsfunction inscripts/src/gpt_image_cli/cli.pycallssubprocess.runwith an argument list rather than a shell string, effectively mitigating command injection risks. - [EXTERNAL_DOWNLOADS]: The CLI fetches generated image data from OpenAI's API endpoints. Evidence:
scripts/src/gpt_image_cli/cli.pyusesurllib.request.urlopento download image bytes from URLs returned by the official OpenAI SDK. This behavior is consistent with the skill's primary purpose and targets trusted infrastructure. - [SAFE]: The skill implements standard authentication practices by loading API keys from environment files. Evidence:
scripts/src/gpt_image_cli/cli.pyresolves theOPENAI_API_KEYby checking the current directory and the user's home directory for.envfiles, which is a common and safe practice for developer tools.
Audit Metadata