Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward SnapOG API helper, but users should treat image parameters, asset URLs, signed URLs, and the API key as sensitive.
Install only if you are comfortable sending the image text, template parameters, and referenced asset URLs to SnapOG. Do not use secrets, private URLs, confidential campaign data, or regulated personal data in parameters. Keep SNAPOG_API_KEY out of code, logs, screenshots, and shared command history, and treat signed image URLs as bearer-style links that may be visible wherever they are embedded.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl https://api.snapog.dev/v1/templates
Returns all templates with their paramSchema (parameter names, types, required fields, defaults). Always call this first if the user hasn't specified a template.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl https://api.snapog.dev/v1/templates
Returns all templates with their paramSchema (parameter names, types, required fields, defaults). Always call this first if the user hasn't specified a template.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl https://api.snapog.dev/v1/templates
Returns all templates with their paramSchema (parameter names, types, required fields, defaults). Always call this first if the user hasn't specified a template.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl https://api.snapog.dev/v1/templates
Returns all templates with their paramSchema (parameter names, types, required fields, defaults). Always call this first if the user hasn't specified a template.
The skill instructs users to send titles, tags, author names, and publicly accessible asset URLs to a third-party API, but it does not warn that this user-provided content leaves the local environment and is transmitted to SnapOG. This creates a privacy and data-handling risk because users may unknowingly submit sensitive text, internal branding assets, or confidential URLs to an external service.
The generate endpoint sends user-supplied content and potentially external asset URLs to a third-party API using an authenticated request. In this skill context, that behavior is core functionality, but it still poses a real data exposure risk if users provide sensitive text, internal metadata, or private resource URLs without warning.
Use this for downloading images or advanced options:
curl -X POST https://api.snapog.dev/v1/generate \
-H "Authorization: Bearer $SNAPOG_API_KEY" \
-H "Content-Type: application/json" \
-d '{
The URL-based generation flow places content parameters directly into the query string, which can be exposed through browser history, logs, referrer headers, analytics systems, and shared HTML or markdown. In addition to external transmission, this makes accidental disclosure more likely than a POST body workflow.
Use this when the user needs a URL to embed in HTML meta tags, markdown, or anywhere an image URL is needed:
https://api.snapog.dev/v1/og/blog-post?title=Building+with+MCP&author=Taylor&tags=AI,Tools
This URL itself serves the image. Parameters are query strings. Requires Authorization header or a signed URL.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl https://api.snapog.dev/v1/preview/blog-post --output preview.png
Renders the template with its default parameters. Useful for showing the user what a template looks like before customizing.
Creating signed URLs delegates access to generated images via bearer-style tokens embedded in the URL. If those links are shared, logged, cached, or leaked through referrers, unauthorized parties may access the generated content until expiry.
Signed URLs let you embed images in <meta> tags without exposing the API key:
curl -X POST https://api.snapog.dev/v1/sign \
-H "Authorization: Bearer $SNAPOG_API_KEY" \
-H "Content-Type: application/json" \
-d '{
The returned signed URL contains access parameters in the URL itself and is intended for direct embedding in HTML metadata. Such URLs are prone to leakage through page source inspection, CMS logs, analytics pipelines, and downstream caching layers, which can expose access to the image resource until the token expires.
}'
Returns `{ "url": "https://api.snapog.dev/v1/og/blog-post?title=...&token=..." }`. This URL works without authentication and can be placed directly in HTML:
```html
<meta property="og:image" content="SIGNED_URL_HERE" />
The batch endpoint increases the volume of user content and asset references sent to the third-party service in a single operation. While expected for the feature, it amplifies privacy exposure and operational impact if users submit sensitive data or private asset URLs.
Generate the same image in multiple sizes at once:
curl -X POST https://api.snapog.dev/v1/batch \
-H "Authorization: Bearer $SNAPOG_API_KEY" \
-H "Content-Type: application/json" \
-d '{
The skill states that the API key is read from the SNAPOG_API_KEY environment variable, but it does not include guidance on safe credential handling. While the examples do not explicitly leak the secret, the omission may encourage unsafe operational practices such as exposing the key in logs, screenshots, shared shell history, or embedded URLs.
No suspicious patterns detected.