skills/toolshell/skills/flux-image/Gen Agent Trust Hub

flux-image

Pass

Audited by Gen Agent Trust Hub on Mar 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the infsh CLI tool to interact with the inference.sh platform for image generation tasks. Evidence: Found in the allowed-tools configuration and multiple usage examples such as infsh app run falai/flux-dev-lora.
  • [EXTERNAL_DOWNLOADS]: The skill references external installation commands for its dependencies from the official provider. Evidence: Recommends using npx skills add inference-sh/skills@agent-tools to install the required environment.
  • [PROMPT_INJECTION]: The skill handles user-provided prompts and URLs, which presents a surface for indirect prompt injection. Ingestion points: Data is accepted through the prompt and image_url fields in the infsh command JSON input. Boundary markers: Input data is encapsulated within a structured JSON payload. Capability inventory: The skill's actions are restricted to those provided by the infsh tool. Sanitization: No additional sanitization is performed on the prompt strings within the skill's static instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 7, 2026, 12:12 PM