openrouter-image-generate
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The main generation script safely invokes a bundled background removal script using
subprocess.runwith argument lists andsys.executable. This design avoids shell injection vulnerabilities.\n- [EXTERNAL_DOWNLOADS]: The skill communicates with the OpenRouter API (openrouter.ai) to generate images. OpenRouter is a well-known service in the artificial intelligence domain.\n- [SAFE]: The script implements standard practices for secret management, searching forOPENROUTER_API_KEYin environment variables or project-level.envfiles without exposing them in shell history.\n- [PROMPT_INJECTION]: The skill processes user prompts and optional reference image files as part of its core image generation functionality. \n - Ingestion points: Text prompts and image file paths are ingested via command-line arguments in
scripts/openrouter_image_generate.py.\n - Boundary markers: No specific boundary markers or instruction-ignoring wrappers are used for the prompts.\n
- Capability inventory: The skill has network access, file read/write capabilities, and the ability to execute local scripts.\n
- Sanitization: Input prompts and image references are checked for existence/format but are otherwise passed directly to the generation service as intended for the tool's operation.
Audit Metadata