skills/tul-sh/skills/image-upscaling/Gen Agent Trust Hub

image-upscaling

Pass

Audited by Gen Agent Trust Hub on Mar 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the infsh command-line interface to execute image processing workflows. It uses infsh login for user authentication and infsh app run to trigger remote models like Real-ESRGAN and Topaz. These operations are standard for the tool's intended use.
  • [EXTERNAL_DOWNLOADS]: The skill recommends using npx skills add to fetch additional functionality from the inference-sh/skills repository. Because this repository belongs to the official vendor (tul-sh), these references are documented as safe vendor operations.
  • [PROMPT_INJECTION]: The skill accepts user-provided image URLs for processing, which establishes an attack surface for indirect prompt injection (e.g., instructions hidden within the image metadata or content).
  • Ingestion points: The image_url field within the JSON input for infsh app run commands across the SKILL.md file.
  • Boundary markers: Absent.
  • Capability inventory: The skill can execute remote image processing applications via the infsh tool.
  • Sanitization: Absent; the skill passes the URLs directly to the external inference.sh platform for processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 12, 2026, 08:26 AM