matting
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a legitimate tool for processing images via a remote service. It includes technical safeguards such as image decompression bomb protection (via Pillow), size and pixel limits, and rigorous validation of output file structure (PNG format and alpha channel presence).
- [DATA_EXFILTRATION]: While the skill transmits image data to a remote service, the destination endpoint is controlled by the user through a local configuration file (
agent_config.toml). The skill explicitly instructs the agent not to output authentication headers or API keys in the console, protecting sensitive credentials. - [INDIRECT_PROMPT_INJECTION]: The skill processes external image files. It mitigates potential risks by performing technical validation on the binary content and does not extract or interpret embedded text as instructions for the agent. The capabilities are limited to matting operations and atomic file writing.
- [COMMAND_EXECUTION]: The skill utilizes a CLI interface via
uv run. The scripts handle arguments safely using standard library parsers and do not execute arbitrary shell commands with user-controlled input.
Audit Metadata