gpt-image-2
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data (file paths and URLs) and possesses network and file-access capabilities, creating a surface for indirect prompt injection.\n
- Ingestion points: The script
scripts/gpt_image.pyaccepts local file paths and remote URLs via command-line arguments such as--image,--mask, and--input-image-url.\n - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are wrapped around the user-supplied inputs before they are incorporated into the API request payload.\n
- Capability inventory: The skill can read local files (
Path.read_bytes), write results to the filesystem (Path.write_bytes), and transmit data over the network (urllib.request.urlopen).\n - Sanitization: The tool performs technical validation (size, format, pixel counts) but does not sanitize the contents of input files or metadata for potential malicious instructions intended for the processing LLM.\n- [COMMAND_EXECUTION]: The skill contains logic to execute its own script within its test suite.\n
- Evidence: The file
tests/test_gpt_image.pyusessubprocess.runto callscripts/gpt_image.pyvia thesys.executableinterpreter to perform regression testing on CLI arguments. This is a standard and benign development practice.
Audit Metadata