aimlapi-media-gen
Pass
Audited by Gen Agent Trust Hub on Mar 3, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill scripts ingest untrusted prompts and URLs which could lead to indirect prompt injection if the upstream API is compromised or misled.\n
- Ingestion points: Found in
scripts/gen_image.pyandscripts/gen_video.pyvia the--promptand--image-urlarguments.\n - Boundary markers: No explicit delimiters or instruction filtering are applied to the input strings.\n
- Capability inventory: Includes network operations (
urllib.request), local file reads (pathlib.Path.read_bytes), and local file writes (pathlib.Path.write_bytes).\n - Sanitization: The scripts use a whitelist to filter additional JSON parameters provided via the
--extra-jsonflag.\n- [EXTERNAL_DOWNLOADS]: The skill downloads generated media files fromapi.aimlapi.comor from URLs provided by the API's successful response.\n- [SAFE]: No critical security vulnerabilities, such as hardcoded credentials, obfuscation, or unauthorized privilege escalation, were detected. The file access logic for API keys and image encoding is restricted to user-provided paths.
Audit Metadata