cowart-image-edit
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill extracts natural language instructions from untrusted image data (screenshots).
- Ingestion points: Workflow step 2 instructions require the agent to "Read visible 批注 labels, arrows, and nearby edit notes from the screenshot itself."
- Boundary markers: The skill instructs the agent to focus on "edit requirements" and "remove all annotation artifacts" in step 4, but does not define strict delimiters or safety wrappers for the extracted text when passed to the image generation tool.
- Capability inventory: The skill can write files to the local
$CODEX_HOME/generated_imagesdirectory and modify the Cowart canvas state using theinsert_cowart_imageMCP tool. - Sanitization: There is no evidence of sanitization, filtering, or validation of the text content extracted from screenshots before it is interpolated into the generation prompt.
Audit Metadata