background-removal

Pass

Audited by Gen Agent Trust Hub on Mar 10, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the infsh CLI tool to interact with the inference.sh platform. It requires the Bash(infsh *) tool to execute commands such as infsh login and infsh app run. These commands are standard for the tool's intended functionality of running AI models for image processing.
  • [EXTERNAL_DOWNLOADS]: The documentation mentions using npx skills add to install additional skills from the inference-sh/skills repository. These are vendor-provided resources associated with the skill author.
  • [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it processes untrusted data through image_url and prompt parameters in CLI commands.
  • Ingestion points: image_url and prompt fields within the infsh app run commands in SKILL.md.
  • Boundary markers: None identified in the provided command templates.
  • Capability inventory: Bash(infsh *) tool permission defined in SKILL.md allows execution of platform-specific CLI commands.
  • Sanitization: No explicit sanitization or validation of the input URLs or prompts is described within the skill's instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 10, 2026, 09:32 PM