baoyu-image-gen
Pass
Audited by Gen Agent Trust Hub on Apr 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads image data from several well-known AI provider APIs, including OpenAI, Google, Azure, OpenRouter, DashScope, MiniMax, Jimeng, Seedream, and Replicate. These operations are essential to the skill's primary function of AI image generation.
- [COMMAND_EXECUTION]: The Google provider script uses the
curlutility to handle API requests when a network proxy is detected. This is a targeted workaround for known connection issues in the Bun runtime's native fetch implementation and uses a controlled argument structure. - [SAFE]: The skill manages sensitive API keys through environment variables and local
.envfiles located in standard directories (.baoyu-skills/or~/.baoyu-skills/), adhering to secure configuration practices for local tools.
Audit Metadata