qwen-image-gen
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a structured workflow for generating and editing image prompts. It does not perform any network operations or access sensitive system files.
- [SAFE]: The repository includes a Node.js runtime (
core.mjs) and a Python script (prepare_workbench_request.py) designed for local execution. Both components implement strict input validation and secure file handling, such as setting owner-only (0600) permissions on generated request files. - [SAFE]: Robust protection against directory traversal is implemented in the skill loading logic, ensuring that only intended instruction files within the skill directory can be read.
- [SAFE]: The skill's instructions and documentation explicitly emphasize security best practices, instructing users to manage API credentials locally and never include them in prompts or shared files.
- [SAFE]: The use of subprocesses in the test suite is strictly controlled and limited to verifying the local utility script's behavior with deterministic arguments.
Audit Metadata