image-gen
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions in
SKILL.mdguide the agent to execute a local Python script (generate_image.py) to interact with the image generation service. - Evidence:
python3 "$SKILL_PATH/scripts/generate_image.py" "<提示词>" - [EXTERNAL_DOWNLOADS]: The Python script makes a network request to
https://doubaoya.com/api/skills/gpt-image-gen/invokeusing the standardurlliblibrary. This is a functional requirement for the skill to communicate with the vendor's API. - Evidence:
ENDPOINT = "https://doubaoya.com/api/skills/gpt-image-gen/invoke"inscripts/generate_image.py. - [CREDENTIALS_SAFE]: The skill follows security best practices by reading the API key from an environment variable (
DOUBAOYA_API_KEY) rather than hardcoding it or accepting it as a command-line argument that might be logged. - Evidence:
api_key = os.environ.get("DOUBAOYA_API_KEY")inscripts/generate_image.py.
Audit Metadata