Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Character Image Generator
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill largely matches its stated purpose (character image generation) and only asks for the expected API key and Node tooling, but there are internal documentation inconsistencies about reference-image handling and how/when the API key is persisted that merit caution before installing.
This skill appears to be what it claims — a character-focused image-generation CLI that calls a WeryAI gateway and needs one API key. Before installing, check two things: (1) Decide whether you want the agent to persist the IMAGE_GEN_API_KEY on disk (the skill contains guidance both to persist only when --persist-api-key is used and to 'prefer writing it locally on the user's behalf' — clarify expected behavior during setup). If you do persist the key, prefer storing it in a project-specific .image-skills path and confirm who has access to that machine. (2) Confirm which reference-image behavior you want: SKILL.md says public HTTPS URLs only, but other docs and vendor scripts indicate the CLI can encode local files as data: URIs. If you need strict local-file rejection or allow local reference images, test the CLI (use --dry-run) in a safe environment first. If you are not comfortable with the agent writing secrets to disk, do not authorize automated persistence; instead provide the API key via environment variable or run setup manually. Finally, if you don't trust WeryAI / the gateway, do not supply the key.
Static analysis
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Dangerous exec
Critical
- Finding
- Shell command execution detected (child_process).
Env credential access
Critical
- Finding
- Environment variable access combined with network send.
Env credential access
Critical
- Finding
- Environment variable access combined with network send.
Potential exfiltration
Warn
- Finding
- File read combined with network send (possible exfiltration).
Potential exfiltration
Warn
- Finding
- File read combined with network send (possible exfiltration).
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.