image-edit
Pass
Audited by Gen Agent Trust Hub on Feb 19, 2026
Risk Level: SAFENO_CODE
Full Analysis
- NO_CODE (SAFE): The skill package consists entirely of markdown and text-based description files. No executable scripts (Python, JavaScript, etc.) are included in the provided files.
- INDIRECT_PROMPT_INJECTION (LOW): The skill defines an interface for processing untrusted user input via the
--promptand--inparameters. While this presents an indirect prompt injection surface, it is inherent to the tool's primary purpose and is not exploited by the skill's own logic. Evidence Chain: 1. Ingestion points:--prompt(text) and--in(path/URL) in SKILL.md; 2. Boundary markers: Absent in the command-line usage; 3. Capability inventory: Executes externalagent-mediacommand; 4. Sanitization: Not specified in documentation.
Audit Metadata