Security audit
Security checks for vulnerabilities and agentic risk
The skill has a coherent image-generation purpose, but it handles API keys and local files too broadly for a normal install.
Review this skill before installing. Use a limited WeryAI key, avoid persisting it unless you accept plaintext local storage, inspect any generated batch `ref` paths before running generation, and prefer a controlled environment because unpinned `npx` execution and broad local-reference handling increase exposure.
scripts/vendor/shared-image-generation/scripts/main.ts:192WeryAI API Key Can Be Forwarded to an Arbitrary Download Origin
scripts/vendor/shared-image-generation/scripts/main.ts:304Unrestricted Reference Paths Permit Arbitrary Local File Upload
scripts/vendor/weryai-image/run-generate.mjs:35Unpinned Remote Bun Package Executes with the Full Secret-Bearing Environment
scripts/vendor/shared-image-generation/scripts/setup.mjs:117Persisted API-Key File Is Created Without Restrictive Permissions
The skill is marketed as structured RedNote series generation, but the described behavior looks like generic text-to-image submission with little enforceable RedNote-specific logic. That mismatch can mislead users into granting access to a low-level generation pipeline that is broader and less constrained than the name and description imply.
The skill is marketed as structured RedNote series generation, but the described behavior looks like generic text-to-image submission with little enforceable RedNote-specific logic. That mismatch can mislead users into granting access to a low-level generation pipeline that is broader and less constrained than the name and description imply.
The skill is marketed as structured RedNote series generation, but the described behavior looks like generic text-to-image submission with little enforceable RedNote-specific logic. That mismatch can mislead users into granting access to a low-level generation pipeline that is broader and less constrained than the name and description imply.
The skill is marketed as structured RedNote series generation, but the described behavior looks like generic text-to-image submission with little enforceable RedNote-specific logic. That mismatch can mislead users into granting access to a low-level generation pipeline that is broader and less constrained than the name and description imply.
The skill is marketed as structured RedNote series generation, but the described behavior looks like generic text-to-image submission with little enforceable RedNote-specific logic. That mismatch can mislead users into granting access to a low-level generation pipeline that is broader and less constrained than the name and description imply.
The skill is marketed as structured RedNote series generation, but the described behavior looks like generic text-to-image submission with little enforceable RedNote-specific logic. That mismatch can mislead users into granting access to a low-level generation pipeline that is broader and less constrained than the name and description imply.
The skill is marketed as structured RedNote series generation, but the described behavior looks like generic text-to-image submission with little enforceable RedNote-specific logic. That mismatch can mislead users into granting access to a low-level generation pipeline that is broader and less constrained than the name and description imply.
The skill is marketed as structured RedNote series generation, but the described behavior looks like generic text-to-image submission with little enforceable RedNote-specific logic. That mismatch can mislead users into granting access to a low-level generation pipeline that is broader and less constrained than the name and description imply.
The skill is marketed as structured RedNote series generation, but the described behavior looks like generic text-to-image submission with little enforceable RedNote-specific logic. That mismatch can mislead users into granting access to a low-level generation pipeline that is broader and less constrained than the name and description imply.
The skill is marketed as structured RedNote series generation, but the described behavior looks like generic text-to-image submission with little enforceable RedNote-specific logic. That mismatch can mislead users into granting access to a low-level generation pipeline that is broader and less constrained than the name and description imply.
Referenced artifact was not completely inspected
**Dependencies:** `scripts/scaffold.ts`, `scripts/build-prompts.ts`, `scripts/build-batch.ts`, the bundled runtime under `scripts/vendor/`, `IMAGE_GEN_API_KEY`,
Referenced artifact was not completely inspected
**Dependencies:** `scripts/scaffold.ts`, `scripts/build-prompts.ts`, `scripts/build-batch.ts`, the bundled runtime under `scripts/vendor/`, `IMAGE_GEN_API_KEY`,
Referenced artifact was not completely inspected
**Dependencies:** `scripts/scaffold.ts`, `scripts/build-prompts.ts`, `scripts/build-batch.ts`, the bundled runtime under `scripts/vendor/`, `IMAGE_GEN_API_KEY`,
Referenced artifact was not completely inspected
**Dependencies:** `scripts/scaffold.ts`, `scripts/build-prompts.ts`, `scripts/build-batch.ts`, the bundled runtime under `scripts/vendor/`, `IMAGE_GEN_API_KEY`,
Referenced artifact was not completely inspected
**Dependencies:** `scripts/scaffold.ts`, `scripts/build-prompts.ts`, `scripts/build-batch.ts`, the bundled runtime under `scripts/vendor/`, `IMAGE_GEN_API_KEY`,
Referenced artifact was not completely inspected
**Dependencies:** `scripts/scaffold.ts`, `scripts/build-prompts.ts`, `scripts/build-batch.ts`, the bundled runtime under `scripts/vendor/`, `IMAGE_GEN_API_KEY`,
Referenced artifact was not completely inspected
**Dependencies:** `scripts/scaffold.ts`, `scripts/build-prompts.ts`, `scripts/build-batch.ts`, the bundled runtime under `scripts/vendor/`, `IMAGE_GEN_API_KEY`,
Referenced artifact was not completely inspected
**Dependencies:** `scripts/scaffold.ts`, `scripts/build-prompts.ts`, `scripts/build-batch.ts`, the bundled runtime under `scripts/vendor/`, `IMAGE_GEN_API_KEY`,
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
--lang <code> On-canvas text language when needed (default placeholder: zh)
--aspect <ratio> Aspect ratio (default: 3:4)
--cards <count> Number of cards to scaffold (default: 5)
--force Overwrite existing files
-h, --help Show help`);
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace);
const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null;
const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env");
const projectEnvFile = pathExists(projectEnvPath);
let apiKeyInProjectEnv = false;
if (projectEnvFile) {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace);
const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null;
const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env");
const projectEnvFile = pathExists(projectEnvPath);
let apiKeyInProjectEnv = false;
if (projectEnvFile) {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace);
const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null;
const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env");
const projectEnvFile = pathExists(projectEnvPath);
let apiKeyInProjectEnv = false;
if (projectEnvFile) {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace);
const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null;
const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env");
const projectEnvFile = pathExists(projectEnvPath);
let apiKeyInProjectEnv = false;
if (projectEnvFile) {
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
}
function applyStylePreset(prompt: string, style: StylePreset | null | undefined): string {
if (!style) return prompt;
return `${prompt.trim()}\n\nStyle preset (${style}): ${STYLE_PRESETS[style]}.`;
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
-h, --help Show help
What this does:
1) Optionally writes IMAGE_GEN_API_KEY into the local skill .env
2) Runs doctor (read-only)
3) Ensures a MODELS.json exists (writes the bundled starter if missing)
4) Initializes EXTEND.md with Nano Banana 2 if no default model exists yet
Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration