inno-figure-gen

Pass

Audited by Gen Agent Trust Hub on Apr 19, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill interacts with the official Google Gemini API using the well-known google-genai Python library. It does not contain malicious code or unauthorized data access patterns.
  • [EXTERNAL_DOWNLOADS]: The skill declares standard dependencies (google-genai, pillow) within its script metadata. These packages are fetched from official package registries by the uv tool.
  • [COMMAND_EXECUTION]: The skill uses the run_terminal tool to execute its bundled Python script (generate_image.py). The script is a purpose-built wrapper that does not perform arbitrary shell command execution or subprocess spawning based on untrusted input.
  • [CREDENTIALS_UNSAFE]: The skill demonstrates safe credential management by looking for an API key in the GEMINI_API_KEY environment variable or an optional command-line argument. No hardcoded secrets or sensitive configuration files are accessed.
  • [DATA_EXFILTRATION]: Network activity is limited to communication with Google's API services for the primary purpose of image generation. No sensitive local files, such as SSH keys or environment configuration, are read or sent to external servers.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 19, 2026, 01:26 PM