eye-color-changer
Pass
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation provides numerous
curlcommand templates to demonstrate how to interact with theeach::senseAPI endpoint athttps://sense.eachlabs.run/chat. These examples include the use of session IDs for iterative editing and various processing modes. - [EXTERNAL_DOWNLOADS]: The skill facilitates the processing of external images by sending user-provided URLs to the vendor's API. The provided documentation in
references/SSE-EVENTS.mdalso indicates that generated outputs are hosted on the vendor's storage infrastructure atstorage.eachlabs.ai. - [PROMPT_INJECTION]: The skill represents an indirect prompt injection surface as it processes external data (images and user messages) through an AI model.
- Ingestion points: External data enters the context via the
image_urlsandmessagefields in the API requests defined inSKILL.md. - Boundary markers: There are no explicit boundary markers or instructions to ignore potential commands embedded within the input data mentioned in the documentation.
- Capability inventory: The skill's core capability is executing image manipulation requests against an external AI service.
- Sanitization: No specific sanitization or validation steps for input data are described within the provided skill files.
Audit Metadata