depth-map-generation

Pass

Audited by Gen Agent Trust Hub on Apr 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides structured curl command examples to interact with the EachLabs API for depth map processing. These are standard utility calls for the described functionality.
  • [EXTERNAL_DOWNLOADS]: The skill initiates network requests to https://sense.eachlabs.run. This is a vendor-owned domain belonging to the skill's author (eachlabs) used for the core service functionality.
  • [DATA_EXFILTRATION]: The skill demonstrates safe credential handling by using the $EACHLABS_API_KEY environment variable placeholder instead of hardcoding secrets.
  • [PROMPT_INJECTION]: The skill identifies an indirect prompt injection surface as it processes external image URLs and streams data from API responses. However, the risk is negligible as the skill lacks dangerous local capabilities such as file system modification or arbitrary code execution.
  • Ingestion points: User-provided image_urls and content within Server-Sent Events (SSE) such as text_response or clarification_needed fields.
  • Boundary markers: None identified.
  • Capability inventory: Network operations limited to the vendor API (sense.eachlabs.run).
  • Sanitization: None identified.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 2, 2026, 02:04 AM