chatgpt-images-fallback

Pass

Audited by Gen Agent Trust Hub on Apr 3, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill orchestrates its workflow by using subprocess modules in Python and Node.js to execute internal scripts. For instance, run_pipeline.py invokes run_jobs.py, and run_chatgpt_fallback.mjs calls finalize_download.py. These executions are used for process separation and pipeline management rather than executing untrusted external commands.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with official endpoints for Google Gemini (generativelanguage.googleapis.com) and ChatGPT (chatgpt.com). These are recognized as well-known and trusted services for image generation tasks.
  • [CREDENTIALS_UNSAFE]: The implementation follows security best practices by retrieving the Google API key from environment variables rather than hardcoding sensitive tokens within the source files.
  • [DATA_EXFILTRATION]: No patterns of unauthorized data exfiltration were detected. Browser automation state is maintained locally in a persistent profile directory within the user's home folder.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 3, 2026, 11:53 AM