Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Avatar Image Generator
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill’s code, required binaries, and environment variable (IMAGE_GEN_API_KEY) are consistent with an avatar/profile-image generator that talks to the WeryAI gateway and writes local config; nothing in the bundle requests unrelated credentials or an external install URL.
This skill appears coherent with its stated purpose. Before installing or enabling it: (1) Be prepared for the agent to run npm install in the skill directories — allow this only if you trust the package source or run in an isolated environment. (2) The skill may write config and a default model config to .image-skills/... and can persist your IMAGE_GEN_API_KEY to disk if you approve; never paste the key into chat unless instructed to provide it via a secure input and confirm the agent will not echo it. (3) The skill contacts WeryAI docs and API endpoints (https://docs.weryai.com and https://api.weryai.com) — ensure you intend to use that gateway and that the API key you provide is scoped appropriately. (4) The package source/homepage is unknown; if you require higher assurance, review the bundled scripts (they are included) or run the skill in a sandboxed container before granting persistent access or network permissions.
Static analysis
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Env credential access
Critical
- Finding
- Environment variable access combined with network send.
Env credential access
Critical
- Finding
- Environment variable access combined with network send.
Potential exfiltration
Warn
- Finding
- File read combined with network send (possible exfiltration).
Potential exfiltration
Warn
- Finding
- File read combined with network send (possible exfiltration).
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.