Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a straightforward OpenAI image-generation helper that sends user prompts to OpenAI, writes generated files locally, and does not show hidden persistence or deceptive behavior.
Install only if you are comfortable providing an OpenAI API key and sending your prompts to OpenAI for image generation. Use --out-dir to choose where files are written, and avoid putting private or sensitive content in prompts unless you intend to send it to the API provider.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
prompts.append(
f"{random.choice(styles)} of {random.choice(subjects)}, {random.choice(lighting)}"
)
return prompts
def get_model_defaults(model: str) -> tuple[str, str]:
The skill invokes a Python script that uses an API key, writes image files and an HTML gallery, and makes network requests to the OpenAI Images API, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. This creates unnecessary ambient authority: an agent or runtime may grant broader capabilities than operators expect, increasing the risk of unintended file access, outbound requests, or misuse of secrets.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
output_format: str = "",
style: str = "",
) -> dict:
url = "https://api.openai.com/v1/images/generations"
args = {
"model": model,
"prompt": prompt,
No suspicious patterns detected.