Azure Image Gen

• Outcome: Pass
• Latest audit: May 28, 2026, 11:53 AM
• Version:
  1.0.0

Overview

This skill appears to do what it claims: generate images through a user-configured Azure OpenAI account and save local image/gallery files.

Before installing, use a least-privileged Azure OpenAI key, confirm the endpoint and deployment are yours, keep batch counts small unless intentional, choose an output directory you control, and avoid opening generated galleries from prompts containing untrusted HTML or script-like text unless the script is updated to HTML-escape prompt values.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documentation indicates use of environment variables, network access to Azure OpenAI, and file writes for saving images and HTML output, but no permissions are declared. This creates a transparency and governance gap: users or hosting platforms may authorize or run the skill without understanding that it can access secrets, make outbound requests, and write files locally.

VirusTotal

64/64 vendors flagged this skill as clean.