gpt-image

Pass

Audited by Gen Agent Trust Hub on Aug 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a bundled background removal script locally using a secure method. Evidence: The remove_backgrounds function in scripts/src/gpt_image_cli/cli.py calls subprocess.run with an argument list rather than a shell string, effectively mitigating command injection risks.
  • [EXTERNAL_DOWNLOADS]: The CLI fetches generated image data from OpenAI's API endpoints. Evidence: scripts/src/gpt_image_cli/cli.py uses urllib.request.urlopen to download image bytes from URLs returned by the official OpenAI SDK. This behavior is consistent with the skill's primary purpose and targets trusted infrastructure.
  • [SAFE]: The skill implements standard authentication practices by loading API keys from environment files. Evidence: scripts/src/gpt_image_cli/cli.py resolves the OPENAI_API_KEY by checking the current directory and the user's home directory for .env files, which is a common and safe practice for developer tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 23, 2026, 06:37 PM
Security Audit — agent-trust-hub — gpt-image