3d Image Generator
Security checks across malware telemetry and agentic risk
Overview
The skill's code, scripts, and runtime instructions align with a 3D image generation CLI that uses a single gateway API key; nothing requests unrelated credentials or hidden endpoints, though it will install npm packages and may persist your API key to disk after you approve.
This skill appears to be what it claims: a JS-based CLI wrapper around a single image-generation gateway (api.weryai.com) using IMAGE_GEN_API_KEY. Before installing or approving actions: 1) Review the bundled package.json files and any dependency lists so you know what npm packages would be installed. 2) When the agent asks to 'install dependencies' or to run bootstrap/ensure-ready, prefer to run npm install yourself in a trusted environment (or inspect the packages first) rather than allowing automatic installs. 3) If asked to persist your IMAGE_GEN_API_KEY, confirm you trust the gateway (weryai.com) and explicitly consent; consider setting the env var yourself instead of letting the agent write it to disk. 4) Because the skill will write files under .image-skills and may place the key in ~/.image-skills, consider running it in a contained workspace or review those files afterwards. 5) If you want tighter control, decline automatic installs and key persistence and perform those steps manually. Overall the skill is coherent with its purpose, but installing npm dependencies and persisting API keys are the two actions that deserve explicit user attention.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
VirusTotal findings are pending for this skill version.