Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward AI image-generation helper that uses a disclosed third-party API, with privacy and clarity caveats but no hidden or destructive behavior found.
Install only if you are comfortable using SkillBoss as a third-party image service. Avoid submitting confidential prompts, private image URLs, regulated data, or secrets unless you trust SkillBoss's handling of that data.
The trigger list is excessively broad and includes common phrases such as 'image generation', 'generate image', and 'ai art', which can cause unintended invocation in unrelated user contexts. This increases the chance that users unknowingly send prompts or data to the external SkillBoss service, creating privacy and consent risks rather than direct code-execution risk.
The skill documentation demonstrates sending prompts and optional image URLs to a third-party API but does not clearly warn users that their content leaves the local environment. Users may provide sensitive text prompts or private image URLs without understanding that this data will be transmitted to an external service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import requests, os
SkillBoss_API_KEY = os.environ["SkillBoss_API_KEY"]
API_BASE = "https://api.SkillBoss.co/v1"
def pilot(body: dict) -> dict:
r = requests.post(
The code performs an authenticated POST request to an external API and transmits the request body directly, which may include user prompts and image URLs. External transmission is expected for this skill's function, but it is still security-relevant because sensitive user content may be exfiltrated to a third party if users are not clearly informed or if inputs are not constrained.
API_BASE = "https://api.SkillBoss.co/v1"
def pilot(body: dict) -> dict:
r = requests.post(
f"{API_BASE}/pilot",
headers={"Authorization": f"Bearer {SkillBoss_API_KEY}", "Content-Type": "application/json"},
json=body,
Several sections contain non-English or garbled text embedded in an otherwise English skill description, which can impose an undocumented language/locale constraint on users. The file does not explain the locale requirement or offer a language choice, so the mixed-language presentation conflicts with the expectation of user-facing language clarity.
No suspicious patterns detected.