Security audit
Security checks for vulnerabilities and agentic risk
This skill provides a scoped anime-art workflow with clear cost controls and no hidden execution or data collection.
Use reviewed installer and repository revisions, choose a provider you trust with reference images, and confirm generation costs. The scanner's incomplete-inspection notice concerns a version string misidentified as a file reference; all bundled references were inspected.
The installation command uses an unpinned npx skills package, allowing the executable version to change without review. If a future resolved release is compromised, running this command could execute attacker-controlled code with the installer's permissions; this is a supply-chain weakness, not evidence of an MCP server or existing malicious behavior.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
### 4. Stay inside the marked region
When asked to fix a region, touch only that region. Do not expand the scope, do not "improve" neighbouring areas, do not silently fix things that were not reported.
## When a change is provably invisible