depth-map-generation
Pass
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides structured
curlcommand examples to interact with the EachLabs API for depth map processing. These are standard utility calls for the described functionality. - [EXTERNAL_DOWNLOADS]: The skill initiates network requests to
https://sense.eachlabs.run. This is a vendor-owned domain belonging to the skill's author (eachlabs) used for the core service functionality. - [DATA_EXFILTRATION]: The skill demonstrates safe credential handling by using the
$EACHLABS_API_KEYenvironment variable placeholder instead of hardcoding secrets. - [PROMPT_INJECTION]: The skill identifies an indirect prompt injection surface as it processes external image URLs and streams data from API responses. However, the risk is negligible as the skill lacks dangerous local capabilities such as file system modification or arbitrary code execution.
- Ingestion points: User-provided
image_urlsand content within Server-Sent Events (SSE) such astext_responseorclarification_neededfields. - Boundary markers: None identified.
- Capability inventory: Network operations limited to the vendor API (
sense.eachlabs.run). - Sanitization: None identified.
Audit Metadata