Pollinations Image Generator

Security checks across malware telemetry and agentic risk

Overview

This image-generation skill matches its stated purpose, but it needs Review because its shell script can expose the API key and can run unintended local commands through unsafe shell evaluation.

Review or patch the script before installing. Remove eval and call curl with quoted arguments, mask the API key in config output, load only the intended skill-local .env, and parse .user.conf as data rather than sourcing it as shell code. Do not put secrets, personal data, or confidential prompts into image requests sent to Pollinations.ai.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation describes sending prompts to Pollinations.ai for image generation but does not clearly warn users that their prompts are transmitted to an external third-party service. Users may unknowingly submit sensitive, personal, or proprietary data in prompts, creating privacy and data-handling risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script transmits the user's prompt to the remote service at `https://gen.pollinations.ai` to generate images, but it does not provide an explicit privacy notice or confirmation before sending potentially sensitive text off-host. In an agent/skill context, users may assume prompts are processed locally, so secrets, personal data, or proprietary content could be unintentionally disclosed to a third party.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal